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ABSTRACT 


FOR  WANT  OF  A  NAIL:  AN  ASSESSMENT  OF  GLOBAL  POSITIONING  SYSTEM 
SATELLITE  REPLENISHMENT  by  Major  David  E.  Hook,  USAF,  98  pages. 

The  Global  Posidoning  System  (GPS)  has  become  a  vital  component  to  both  the  military 
and  civilian  infrastructures.  U.S.  military  forces  have  evolved  from  using  its  signal  for  routine 
navigation  to  depending  on  it  for  nearly  every  facet  of  combat  operations.  GPS  is  also  seamlessly 
integrated  into  every  major  civil  infrastructure,  including  transportation,  communications,  energy, 
commerce,  banking,  and  emergency  response  services.  In  addition,  the  accuracy  and  worldwide 
availability  of  GPS  has  spawned  a  multi-billion  dollar  international  market  representing  billions 
of  dollars  in  annual  tax  revenue. 

Despite  its  vital  importance,  the  GPS  constellation  is  populated  with  numerous  satellites 
operating  well  beyond  their  design  life.  These  aging  satellites  are  more  likely  to  malfunction, 
which  can  reduce  service  coverage,  degrade  accuracy,  and  in  some  cases,  transmit  dangerously 
inaccurate  data.  The  constellation  is  in  a  frail  state  with  multiple  satellite  failures  predicted  each 
year  for  the  next  several  years. 

The  Air  Force  currently  subscribes  to  the  launch  to  sustain  (LTS)  satellite  replenishment 
strategy.  Under  this  strategy,  new  satellites  are  launched  only  after  a  satellite  failure  or  just  prior 
to  a  failure.  The  purpose  of  this  monograph  is  to  investigate  whether  the  Air  Force  should  forgo 
its  current  LTS  replenishment  strategy  and  adopt  a  more  aggressive  launch  to  augment  (LTA) 
strategy  in  order  to  proactively  eliminate  high  risk  satellites  and  to  accelerate  modernization 
timelines. 

It  will  be  shown  that  the  explosive  growth  of  GPS  over  the  past  fifteen  years  has 
outpaced  the  Air  Force’s  strategy  on  satellite  replenishment.  The  growing  importance  of  GPS 
must  be  matched  with  a  progressive  replenishment  strategy  that  sustains  the  constellation’s 
reliability  and  improves  its  utility  for  military,  commercial,  and  international  users.  Instead,  LTS 
has  placed  a  premium  on  maximizing  individual  satellite  life  in  order  to  reduce  constellation  life 
cycle  costs.  This  has  placed  a  disproportionate  emphasis  on  operational  efficiency  at  the  expense 
of  operational  effectiveness.  Extraordinary  measures  have  been  taken  to  sustain  the  aging 
satellites,  sometimes  at  the  expense  of  signal  accuracy.  These  measures  have  successfully 
extended  satellite  life  expectancy,  but  they  have  also  concealed  the  declining  state  of  health  of  the 
constellation.  Consequently,  the  situation  has  not  commanded  the  attention  it  merits  from  the 
DoD,  and  the  funding  for  new  launches  has  not  received  the  priority  it  deserves.  The  LTS 
strategy  has  also  impaired  the  timely  insertion  of  critical  new  capabilities  into  the  constellation. 
By  permitting  the  failure  rate  of  satellites  to  define  the  launch  rate,  the  Air  Force  has  deferred  the 
replacement  of  older  satellites  with  newer,  more  capable  counterparts  by  several  years. 

The  recommendations  drawn  by  the  author  are  focused  on  adopting  a  more  aggressive 
Launch  To  Augment  replenishment  strategy  in  order  to  proactively  replace  fragile  satellites 
before  they  fail  and  to  accelerate  satellite  modernization  timelines.  The  author  also  proposes 
integrating  a  precautionary  risk  assessment  into  the  satellite  replenishment  deliberate  planning 
process  to  ensure  the  extreme  level  of  uncertainty  inherent  in  satellite  replenishment  decisions  is 
directly  addressed. 
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CHAPTER  ONE:  INTRODUCTION 


For  want  of  a  nail  the  shoe  is  lost, 

For  want  of  a  shoe  the  horse  is  lost, 

For  want  of  a  horse  the  rider  is  lost, 

For  want  of  the  rider  the  battle  is  lost, 

For  want  of  the  battle  the  war  is  lost, 

For  want  of  the  war  the  nation  is  lost, 

All  for  the  want  of  a  horseshoe  nail. 

George  Herbert 

Failing  GPS  Satellites  Make  Smart  Weapons  Dumb 1 

(Associated  Press)  OMAHA,  Neb.  —  Last  week’s  tragic  U.S.  air  strike  that  mistakenly  killed  a 
family  of  five  and  seriously  injured  three  others  in  the  Iraqi  town  of  Klialis  has  been  blamed  on 
the  failure  of  two  navigation  satellites,  military  officials  confirmed  today.  There  was  an 
immediate  backlash  against  the  errant  bombing  when  large  crowds  took  to  the  streets  of  the 
mostly  Sunni  town  to  protest  the  killings.  Town  leaders  have  petitioned  the  Iraqi  Governing 
Council  to  investigate  the  incident  and  to  appeal  to  the  U.S.  government  to  turn  over  the  airmen 
involved  in  the  attack  to  face  criminal  charges. 

The  Pentagon  has  issued  a  written  statement  apologizing  for  the  incident  and  has  said  the  attack 
was  based  on  intelligence  reports  that  a  high-profile  terrorist  leader  was  in  the  area.  F-16  fighter 
jets  patrolling  the  area  targeted  a  500-pound  GPS-guided  Joint  Direct  Attack  Munition  (JDAM) 
on  the  suspected  safe  house.  Photos  show  the  bomb  missed  its  target  by  nearly  30  meters  and 
struck  a  nearby  residence  instead.  The  suspected  terrorist  leader  escaped  injury.  The  Pentagon 
would  not  release  the  names  of  the  pilots  involved  in  the  incident. 

The  two  satellites  are  part  of  the  military’s  Global  Positioning  System,  a  constellation  of  twenty- 
eight  orbiting  satellites  that  provide  precise  positioning  service  to  millions  of  users  worldwide.  A 
spokesman  from  U.S.  Strategic  Command,  the  military  organization  responsible  for  the 
spacecraft,  stated  dual  satellite  failures  have  caused  a  loss  of  GPS  navigation  service  for  a  twenty- 
minute  period  each  day  in  the  Baghdad  region. 

The  first  satellite  to  fail,  satellite  vehicle  number  32  (SVN  32),  malfunctioned  over  the  central 
United  States  nearly  three  weeks  ago.  That  failure  was  followed  a  week  later  by  SVN  25  which 
malfunctioned  while  traversing  over  the  Indian  Ocean.  The  aging  satellites  are  both  well  beyond 
their  life  expectancies  and  have  been  maintained  on  an  Air  Force  Space  Command  “watch  list”  of 
high  risk  satellites  for  over  a  year. 

The  next  launch  to  replenish  the  constellation  has  already  been  delayed  five  months  due  to 
several  launch  processing  problems.  The  launch  from  Cape  Canaveral  Air  Station  aboard  a  Delta 


1  This  is  a  fictitious  news  article.  As  a  pre-mortem  analysis,  its  purpose  is  to  illustrate  the  potential 
military,  political,  and  economic  harm  that  can  result  from  losing  just  two  satellites  in  a  fully  populated 
GPS  constellation.  The  civil  consequences  of  the  anomalies  are  a  composite  of  actual  user  problems 
caused  by  previous  satellite  anomalies. 
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II  launch  vehicle  is  tentatively  scheduled  for  late  next  month  but  officials  have  stated  they  “may 
look  for  ways  to  accelerate  that  launch,  if  possible.” 

The  announcement  today  from  U.S.  Strategic  Command  comes  on  the  heels  of  yesterday’s 
revelation  from  the  Coast  Guard  that  navigation  on  the  Mississippi  River  was  temporarily 
disrupted  three  weeks  ago  after  several  U.S.  Coast  Guard  Differential  GPS  sites  along  the  river 
were  “knocked  off  the  air  until  they  could  be  reset.”  The  sites  were  unable  to  compensate  for  the 
erratic  signals  transmitted  by  the  malfunctioning  SVN  32  as  it  passed  overhead.  The  differential 
sites  transmit  GPS  correction  signals  used  by  ships  to  navigate  the  heavily  congested  river. 

An  official  with  the  Federal  Aviation  Administration,  speaking  on  condition  of  anonymity,  also 
confirmed  that  “half  a  dozen”  domestic  commercial  airliners  experienced  a  complete  loss  of  GPS 
navigation  and  had  to  switch  to  backup  navigation  aids.  The  departure  of  several  international 
flights  was  delayed  while  controllers  and  pilots  waited  for  GPS  service  to  be  restored. 

The  failing  satellite  also  caused  thousands  of  cell  phone  users  in  the  central  plains  states  to  lose 
service  for  several  hours.  Several  hundred  cell  phone  towers  in  the  region  took  erroneous  “time 
hacks”  from  the  satellite,  causing  a  loss  of  synchronization  between  cell  towers.  The  service 
disruption  is  expected  to  cost  mobile  communication  providers  millions  of  dollars. 

Meanwhile,  supporters  of  the  £2  billion  Galileo  navigation  constellation,  Europe’s  version  of 
GPS,  contend  the  two  recent  satellite  failures  point  to  an  ailing  GPS  constellation  and  one  that 
does  not  have  the  necessary  reliability  that  today’s  25  million  worldwide  users  expect.  Europe 
has  been  keen  to  develop  its  own  satellite  positioning  service  to  break  what  it  calls  a  U.S. 
monopoly.  “We  have  five  million  users  in  Europe  today  and  that  is  set  to  rise  to  250  million  in 
the  next  15  years,”  stated  a  European  Space  Agency  official.  “You  can’t  rely  on  a  single  system 
belonging  to  one  country.  Galileo  will  insure  uninterrupted  service  for  not  only  European  users, 
but  for  users  worldwide.”  The  thirty  satellites  that  make  up  the  Galileo  constellation  are 
scheduled  to  be  operational  in  2008. 2 

Central  Command  officials  refused  to  comment  on  the  likely  impact  the  loss  of  GPS  will  have  on 
operations  in  Iraq  while  they  wait  for  a  replacement  satellite.  However,  there  is  evidence  that 
soldiers’  confidence  in  the  system  may  be  the  first  military  casualty  of  the  malfunctions. 

"It’s  a  very  unfortunate  situation,”  said  a  clearly  frustrated  battalion  commander  with  the  173rd 
Airborne  Brigade  responsible  for  patrolling  this  small  town  located  35  miles  north  of  Baghdad. 
“After  many  months  of  hard  work,  we  were  finally  gaining  the  fragile  trust  and  support  of  the 
local  population.  I  thought  we  had  turned  the  corner  and  were  making  real  progress.  But  after  an 
accident  like  this,”  he  paused,  “you  have  to  go  back  to  square  one  and  start  all  over.  There  has 
been  a  definite  spike  in  the  number  of  attacks  against  my  patrols  since  the  accident.” 

“Usually  GPS  is  dead-on  accurate.  I  really  don’t  know  how  we  ever  managed  without  it,”  shared 
a  paratrooper.  “With  GPS,  I  know  exactly  where  my  unit  is  on  the  battlefield.  I  can  call  in  long- 
range  fires  without  fear  of  fratricide.  But  with  the  rumors  about  GPS  no  longer  being  reliable,  I 
just  hope  I  can  count  on  it  when  I  absolutely  need  it.” 


2  The  information  pertaining  to  the  Galileo  constellation  was  referenced  from  Ian  Sample,  "Europe 
to  Back  Satellite  Positioning  System,"  NewScientist.com ,  [Internet]  (25  March  2002,  accessed  6  January 
2004);  available  from  http://www.newscientist.com/. 
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Background 


The  designers  of  the  Global  Positioning  System  (GPS)3  could  never  have  anticipated  the 
exponential  growth  of  the  position,  navigation,  and  timing  (PNT)  system  when  it  was  first  fielded 
over  twenty-five  years  ago.  What  was  originally  intended  to  simply  improve  military  worldwide 
en  route  navigation  has  now  matured  into  the  glue  that  binds  the  military’s  transformation 
efforts.4  U.S.  military  forces  have  evolved  from  using  GPS  for  routine  operations  to  depending 
on  it  for  nearly  every  aspect  of  combat  operations.  With  new  and  innovative  applications  being 
discovered  almost  monthly,5  the  U.S.  military  is  becoming  increasingly  dependent  on  this  space 
service.  In  their  paper  “GPS  at  War:  A  Ten  Year  Retrospective,”  James  M.  Hasik  and  Michael 
Russell  Rip  discuss  the  “precis  ion  revolution”  GPS  has  fostered  while  also  exposing  the  potential 
vulnerabilities  it  brings  to  the  joint  force: 

It  is  doubtful  that  any  technology  since  nuclear  weaponry  has  had  such  a  dramatic  influence 
on  military  strategy  [as  GPS].  Today,  GPS  is  the  glue  that  binds  together  modern  military 
operations,  and  its  promises  and  pitfalls  sits  at  the  core  of  the  question  of  military 
transformation.  This  is  true  because  GPS’  lethal  combination  of  inexpensive  precision, 
standoff  range,  adverse  weather  performance,  and  operational  flexibility  has  prompted 
military  forces  the  world  over  to  adopt  it  with  blinding  speed.6 

GPS  has  become  so  pervasive  its  loss  could  be  catastrophic,  hence  making  it  a  critical 

vulnerability  to  the  Joint  Force  Commander.7 

Civilian  and  commercial  users  of  GPS  have  also  come  to  depend  on  GPS’  reliable  and 
accurate  navigation  and  timing  signal.  GPS  is  now  seamlessly  and  invisibly  integrated  into  every 
major  civil  infrastructure,  including  transportation,  communications,  energy,  commerce,  banking. 


3  Readers  may  wish  to  reference  Appendix  A  for  a  brief  overview  of  the  system. 

4  James  M.  Hasik  and  Michael  Russell  Rip,  "GPS  at  War:  A  Ten- Year  Retrospective,"  ION  GPS 
2001 ,  11-14  September  2001 ,  Salt  Lake  City,  UT,  2406. 

5  Michael  Russell  Rip  and  James  M.  Hasik,  The  Precision  Revolution:  GPS  and  the  Future  of 
Aerial  Warfare  (Annapolis,  MD:  Naval  Institute  Press,  2002),  232. 

6  Hasik  and  Rip,  2406. 

7  Michael  McPherson,  “GPS  and  the  Joint  Force  Commander:  Critical  Asset,  Critical 
Vulnerability.”  (Naval  War  College,  18  May  2001),  8-13. 
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and  emergency  response  services.8  These  industries  have  quickly  come  to  realize  the  untapped 
potential  of  GPS  information  to  meet  the  growing  requirements  for  improved  productivity, 
efficiency,  and  safety.  GPS  truly  has  become  an  international  utility  in  its  own  right. 

Continued  growth  of  GPS  and  its  acceptance  as  the  international  standard  are  based  on 
the  assumption  GPS  will  continue  to  provide  the  same  unsurpassed  global  performance  that  it  has 
for  the  past  decade.  Civil  and  commercial  users  expect  the  GPS  signal  to  be  reliable,  stable,  and 
predictable  and  one  they  can  plan  around,  similar  to  the  dependability  of  a  wall  outlet  to  deliver 
electricity. 9  These  expectations  are  often  well  beyond  what  the  original  constellation  was 
designed  to  support  and  beyond  current  funding  levels.  Nevertheless,  this  “expectation  creep” 
has  become  the  cle  facto  performance  standard. 

In  recognition  of  the  growing  importance  of  GPS  to  the  emerging  global  information 
infrastructure,  the  Clinton  Administration  released  a  comprehensive  national  policy  on  the  use 
and  management  of  GPS.  The  presidential  decision  directive  (PDD  NSC-6)  reaffirmed  the 
Defense  Department’s  responsibility  to  acquire,  operate,  and  maintain  the  basic  GPS  service  and 
to  continue  to  provide  the  civil  signal  for  “peaceful  civil,  commercial  and  scientific  use  on  a 
continuous  basis,  free  of  direct  users  fees.”10  One  of  the  most  important  tasks  inherent  in  these 
stewardship  responsibilities  is  the  sustainment  of  a  fully  operational  constellation  of  GPS 
satellites.  The  current  constellation  replenishment  strategy  is  based  on  federal  government 
policy,  as  stated  in  the  2001  Federal  Radionavigation  Plan,  to  sustain  no  less  than  twenty-four 


'  L.  Paul  Bremer  HI  and  Edwin  Meese  III,  Defending  the  American  Homeland  (Washington,  D.C.: 
Heritage  Foundation,  2002),  19. 

9  Scott  Pace  and  others.  The  Global  Positioning  System:  Assessing  National  Policies  (Santa 
Monica,  CA:  RAND,  1995),  96. 

111  The  White  House,  Office  of  Science  and  Technology  Policy,  National  Security  Council,  "Fact 
Sheet:  U.S.  Global  Positioning  System  Policy"  [Internet]  (29  March  1996,  accessed  7  August  2003); 
available  from  http://www.ostp.gov/NSTC/htmPpdd6.html. 
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operating  satellites  in  the  GPS  constellation.11  Today,  the  constellation  consists  of  twenty -eight 
satellites,  but  with  many  satellites  operating  well  beyond  their  life  expectancies. 

On  the  eve  of  Operation  Iraqi  Freedom  (OIF),  seventeen  of  the  twenty-eight  satellites 
were  older  than  their  design  life  of  7.5  years,  fifteen  satellites  had  lost  redundancy  in  a  critical 
subsystem  and  were  one  component  away  from  complete  satellite  failure,  and  one  satellite  had 
completely  failed  and  was  awaiting  disposal. 12  These  aging  satellites  are  more  likely  to 
malfunction,  which  can  induce  severe  navigation  and  timing  errors.  In  addition  to  design  life 
being  a  probabilistic  limiting  factor,  random  hard  failures  can  also  cause  unexpected  mission 
failure.  The  randomness  of  component  failures  and  the  limited  data  on  the  statistically  small 
number  of  satellites  prevents  the  Air  Force  from  precisely  predicting  when  a  satellite  will  fail  or 
what  components  might  break  next.  Moreover,  the  failure  of  a  single  satellite  can  have  a 
significant  impact  on  its  users.  Failures  can  reduce  coverage,  degrade  accuracy,  and  in  some 
cases,  transmit  dangerously  inaccurate  data. 

To  further  compound  the  problem,  reconstitution  of  the  satellite  fleet  was  impossible 
during  the  twelve  months  leading  up  to  the  war  due  to  a  series  of  complications  with  the  Delta  II 
launch  vehicle,  the  only  space  launch  vehicle  capable  of  launching  GPS  satellites.  This  extended 
launch  delay  was  not  merely  an  isolated  incident  that  can  be  easily  written  off  to  happenstance; 
this  was  the  third  launch  incident  in  the  past  five  years. 13  The  launch  vehicle  problem  was  finally 
rectified  with  a  successful  launch  in  January  2003  prior  to  the  start  of  ground  operations  in  Iraq. 
Fortunately,  the  constellation  weathered  this  critical  period  and  performed  flawlessly.14 

1 1  Department  of  Defense  and  Department  of  Transportation,  2001  Federal  Radionavigation  Plan 
(Springfield,  VA:  National  Technical  Information  Service,  2001),  3-1. 

12  Capt  Eddie  Meidunas  and  Capt  Mike  Perz,  Navstar  Global  Positioning  System  CSAT 
Presentation  to  CSAT  at  Vandenberg  AFB,  CA  on  27  February  2003. 

13  Andrew  Zolli,  "Oh,  Nooo!  What  If  GPS  Fails?,"  Wired,  May  2003,  40. 

14  Bob  Brewin,  "Pentagon  Tweaked  GPS  Accuracy  to  within  Three  Meters  During  Iraq  War," 
Computerworld ,  [Internet]  (24  June  2003,  accessed  24  July  2003);  available  from 
http://www.computerworld.com/mobiletopics/mobile/story/0%2C10801%2C82464%2C00.html.;  and 
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However,  the  fact  that  no  satellites  failed  during  the  initial  major  combat  operations  is  more 
accurately  attributed  to  chance  than  to  adept  risk  management. 

Long  satellite  life  and  the  length  of  time  required  to  replace  the  entire  constellation  of 
twenty-four  satellites  has  also  obstructed  the  injection  of  new  technology  into  the  constellation. 15 
Accordingly,  modernization  efforts  to  improve  the  security,  accuracy,  and  integrity  of  the  signal 
and  to  make  it  less  susceptible  to  interference  and  enemy  jamming  have  been  slowed  due  to 
extended  launch  schedules.  These  extensions  threaten  the  future  of  GPS  as  the  world’s 
navigation  and  timing  standard  because  international  users  may  lose  confidence  in  the  viability  of 
the  constellation  and  the  willingness  of  the  U.S.  government  to  invest  in  its  maintenance.16 

The  importance  of  these  modernization  enhancements  was  validated  during  Iraqi 
Freedom  when  Iraqi  forces  arrayed  jammers  around  Baghdad  in  a  vain  attempt  to  disrupt 
coalition  air  attacks. 17  Although  their  effectiveness  was  questionable,  the  jammers  send  a  clear 
and  an  unambiguous  statement:  our  enemies  understand  the  value  of  GPS  to  the  “new  American 
way  of  war”  and  will  not  hesitate  to  deny  coalition  forces  access  to  the  valuable  signal. 

Owen  Wormser,  the  Pentagon’s  principal  deputy  for  spectrum,  space,  sensors  and 
command,  control  and  communications,  acknowledged  the  problem  of  the  aging  constellation  in 
an  interview  in  Aviation  Week  and  Space  Technology  prior  to  the  start  of  Iraqi  Freedom.  He 
stated  the  Defense  Department  was  “increasingly  concerned”  that  it  would  not  be  able  to  fix  the 
“rapidly  eroding”  constellation  problem  on  its  own.  Pentagon  officials  accepted  some 


William  B.  Scott  and  Craig  Covault,  "High  Ground  over  Iraq,"  Aviation  Week  &  Space  Technology,  9  June 
2003. 

15  National  Research  Council,  The  Global  Positioning  System:  A  Shared  National  Asset 
(Washington  D.C.:  National  Academy  Press,  1995),  10. 

16  Clifford  W.  Kelley,  Douglas  Mortoccia,  and  Rex  Pendley,  "A  Modernization  Deployment 
Strategy  to  Meet  Military  and  Civil  Needs,"  ION  GPS  1999,  14-17  September  1999,  Nashville,  TN,  1343. 

17  Jeremy  Singer,  "War  in  Iraq  Boosts  Case  for  More  Jam  Resistant  GPS,"  SpaceNews,  [Internet] 
(8  April  2003,  accessed  1  April  2004);  available  from 
http://www.space.com/spacenews/archive03/gpsarch_040703.html. 
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responsibility  for  the  “dire  situation”  because  the  “emerging  crisis”  had  largely  gone  unnoticed  by 
senior  leaders  until  only  recently. 18 

Problem  Statement 

Faced  with  a  frail  GPS  constellation,  a  launch  infrastructure  of  questionable 
responsiveness,  a  growing  urgency  to  accelerate  modernization  timelines,  and  expanding 
performance  expectations,  it  is  time  for  the  DoD  to  critically  review  its  GPS  satellite 
replenishment  strategy.  The  increasing  expectations  and  growing  dependence  on  GPS  suggests  a 
more  conservative  acceptance  of  constellation  risk.  The  Defense  Department  has  an  obligation  to 
ensure  the  reliability  of  this  important  and  valuable  resource  to  domestic  and  international  users, 
as  well  as  to  ensure  its  continued  availability  and  security  in  harsh  battlefield  environments.  An 
effective  satellite  replenishment  strategy  is  essential  to  the  continued  viability  of  GPS. 

The  purpose  of  this  paper  is  to  qualitatively  examine  the  risks  of  the  current  satellite 
replenishment  strategy  and  to  provide  a  new  perspective  in  managing  the  problem.  The  paper 
will  attempt  to  answer  the  research  question,  “Should  the  Air  Force  forgo  its  current  launch  to 
sustain  (LTS)  replenishment  strategy  and  adopt  a  more  aggressive  launch  to  augment  (LTA) 
strategy  in  order  to  proactively  eliminate  high  risk  satellites  and  to  accelerate  modernization 
deployment  timelines?”  It  is  not  the  objective  of  the  paper  to  recommend  a  comprehensive 
solution  to  this  complicated  problem,  but  rather  to  provide  a  new  perspective  from  which  future 
replenishment  decisions  can  be  framed. 

The  GPS  replenishment  strategy  is  the  plan  to  maintain  the  constellation  to  meet  the 
satellite  availability  requirement.  Satellite  availability  is  documented  in  the  “Global  Positioning 
System  Standard  Positioning  Service  Performance  Standard,”  which  defines  the  level  of 

18  Robert  Wall,  "Eroding  GPS  Worries  Pentagon,"  Aviation  Week  &  Space  Technology ,  4 
November  2002,  3 1 . 
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performance  the  U.S.  government  is  committed  to  provide  civil  GPS  users.  This  standard 
mandates: 

...24  operational  satellites  must  be  available  on  orbit  with  0.95  probability  (averaged 
over  any  day).  At  least  21  satellites  in  the  24  nominal  plane/slot  positions  must  be  set 
healthy  and  transmitting  a  navigation  signal  with  0.98  probability  (yearly  averaged). 19 

Satellite  replenishment  decisions  are  primarily  driven  by  this  requirement. 

The  replenishment  strategy  also  “prescribes  the  satellite  positions  that  compose  the 

system  and  the  manner  in  which  those  satellite  positions  will  be  replenished.”20  It  is  similar  to  a 

maintenance  strategy  in  that  it  “initializes  the  system  and  keeps  it  in  operation  a  high  percentage 

of  time  (hopefully)  by  regular  ‘part’  replacement  knowing  that  failures  will  occur  eventually.”21 

This  paper  will  focus  exclusively  on  that  portion  of  the  strategy  that  applies  to  the  timing  of 

replenishment  launches  and  will  leave  the  discussion  of  optimal  satellite  positioning  for  others. 

The  Air  Force  currently  prescribes  to  the  Launch  to  Sustain  (LTS)  replenishment 

strategy.22  Under  this  strategy,  launches  are  scheduled  to  replace  satellites  “nearing  the  end  of 

their  useful  life,  predicted  to  fail,  or  that  fail  abruptly.”23  The  inability  to  accurately  predict 

satellite  and  component  failures  and  the  lack  of  a  consensus  on  what  constitutes  satellite  “useful 

life”  tends  to  make  this  a  reactive  approach  to  satellite  failure. 

The  other  viable  alternative  for  a  mature  constellation  is  the  Launch  to  Augment  (LTA) 

strategy.24  This  strategy  allows  for  “increased  operational  capability  above  the  designed  standard 


19  Assistant  Secretary  of  Defense  for  Command,  Control,  Communications,  and  Intelligence, 
Global  Positioning  System  Standard  Positioning  Sendee  Performance  Standard ,  October  2001,  13. 

20  J.M.  Womack,  GAP  Users  Guide:  Instructions  for  Use  of  the  GAP  ( Preliminary )  (Los  Angeles 
Air  Force  Base,  CA:  Space  and  Missile  Systems  Center,  Air  Force  Materiel  Command,  1995),  27. 

21  Ibid. 

"  Air  Force  Space  Command,  Air  Force  Space  Command  Concept  of  Operations  for  the  Global 
Positioning  System,  28  December  2001,  3-18. 

23  Air  Force  Space  Command,  Air  Force  Space  Command  Instruction  10-1213  Spacelift  Launch 
Strategy  and  Scheduling  Procedures,  2  October  2000,  2. 

24  A  third  strategy.  Launch  to  Deploy,  is  only  used  for  initial  satellite  system  deployment  and  for 
research  and  development  systems.  It  is  therefore  not  discussed  here. 
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in  response  to  war,  crisis,  contingency,  or  theater  need.”25  This  strategy  uses  accelerated  time 
lines,  subject  to  operational  constraints,  to  rapidly  build  enhanced  capabilities. 

Although  the  nation  is  not  in  imminent  danger  of  a  major  catastrophic  failure  of  the 
constellation, 26  one  should  not  be  complacent  about  the  possibility  of  satellite  failures  causing 
localized  outages  or  degraded  service.  These  outages  are  technically  feasible;  it  is  only  the 
probability  of  it  happening  that  is  uncertain.  Also  uncertain  is  the  likelihood  of  a  GPS  failure  to 
induce  cascading  failures  across  interdependent  civilian  and  military  infrastructures.  As  political 
economist  Thomas  Schelling  has  pointed  out,  “There  is  a  tendency  in  our  planning  to  confuse  the 
unfamiliar  with  the  improbable.  The  contingency  we  have  not  considered  looks  strange;  what 
looks  strange  is  thought  improbable;  what  is  improbable  need  not  be  considered  seriously.”27  The 
Space  Commission  Report  completes  this  line  of  thought  by  stating,  “Surprise  is  most  often  not  a 
lack  of  warning,  but  the  result  of  a  tendency  to  dismiss  as  reckless  what  we  consider 
improbable.”28  The  aim  of  this  paper  is  to  illuminate  some  the  “improbable”  and  “unfamiliar” 
consequences  that  can  arise  due  to  a  fragile  GPS  constellation.  It  is  hoped  that  by  doing  so,  we 
shall  heed  the  ready  warnings  and  take  the  necessary  precautions  to  prevent  an  unfortunate 
surprise. 


5  Air  Force  Space  Command,  Launch  Strategy  and  Scheduling  Procedures,  2-3. 

26  Zolli.  40. 

27  Commission  to  Assess  United  States  National  Security  Space  Management  and  Organization,  by 
Flon.  Donald  H.  Rumsfeld,  chairman  (Washington  DC,  2001),  25. 

28  Ibid. 
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CHAPTER  TWO:  AN  EMERGING  CRISIS? 

Failure  does  not  strike  like  a  bolt  from  the  blue;  it  develops  gradually  according 
to  its  own  logic.... complicated  situations  seem  to  elicit  habits  of  thought  that  set 
failure  in  motion  from  the  beginning.  From  that  point,  the  continuing  complexity 
of  the  task  and  the  growing  apprehension  of  failure  encourage  methods  of 
decision  making  that  make  failure  even  more  likely  and  then  inevitable. 

Dietrich  Dorner,  The  Logic  of  Failure  29 

It  has  been  through  talented  operators  and  ingenious  work-arounds  that  GPS 
continues  to  provide  outstanding  performance. 

30 

U.S.  Strategic  Command,  GPS  III  Concept  of  Operations 


The  problem  of  satellite  replenishment  is  deceptively  complex.  The  production  of 
boosters  and  satellites  is  a  very  expensive  endeavor  requiring  long  bad  times. 31  Replace  a 
satellite  too  early  and  scarce  military  dollars  are  needlessly  diverted  from  more  pressing  defense 
needs.  Wait  too  long  and  one  risks  satellite  failures  disrupting  military  operations  or  threatening 
civilian  safety- of- life  applications.  However,  the  timing  of  when  to  replace  a  satellite  and  how 
many  to  acquire  is  clouded  in  uncertainty.  The  decision  to  acquire  new  satellites  must  be  made 
years  in  advance,  sometimes  before  their  predecessors  have  even  reached  orbit.  Due  to  the 
random  nature  of  component  failures  and  limited  on-orbit  reliability  data,  senior  leaders  do  not 
have  the  precise  failure  predictions  needed  to  guide  their  launch  decisions.  Without  a  clear  need 
to  launch,  but  with  undeniable  and  unambiguous  budgetary  pressures,  the  “prudent”  decision 
gradually  becomes  a  “wait  and  see”  approach.  All  the  while,  the  constellation  continues  to  age 
with  few  warning  signs  of  an  impending  failure.  Increasing  reliance,  and  then  outright 


29  Dietrich  Dorner,  The  Logic  of  Failure,  trans.  Rita  and  Robert  Kimber  (New  York:  Metropolitan 
Books,  1996),  10. 

30  U.S.  Strategic  Command,  Global  Positioning  System  III  Concept  of  Operations,  28  Febmary 

2003,  2. 

31  Amy  Butler,  "GPS  Spacecraft  Lasting  Longer  Than  Expected,  Prompting  Possible  IIF  Delay," 
Defense  Daily,  2  December  2003.;  It  costs  approximately  $100  million  to  acquire  a  GPS  satellite  and 
place  it  in  orbit.  It  should  be  noted,  however,  that  the  tax  revenue  generated  from  the  sale  of  GPS  products 
in  the  U.S.  more  than  covers  the  cost  of  the  system.  Assuming  a  conservative  tax  rate  of  25  percent  on  the 
$17  billion  annual  U.S.  GPS  market,  the  tax  income  for  2003  alone  would  top  $4.25  billion.  This  is  more 
than  the  $3-4  billion  cost  of  maintaining  and  operating  GPS  for  ten  years. 
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dependency,  is  placed  on  ingenious  work-arounds  and  software  patches  to  keep  the  system 


functional.  What  emerges  is  a  paradigm  that  places  greater  value  on  extending  individual  satellite 
life  than  limiting  overall  constellation  risk. 

Edward  Tenner  calls  this  paradigm  the  “rearranging  effect.”32  Rearranging  effects  are  the 
result  of  misguided  efforts  to  manage  acute  risks.  The  acute  risks,  however,  are  never  actually 
eliminated  but  are  instead  distributed  or  rearranged  differently.  They  are  broadened  and  shifted 
toward  the  future.  These  gradual,  accumulated  risks  are  sometimes  more  hazardous  than  the 
acute  risks  they  replaced.3  ’  In  attempting  to  maximize  the  life  of  individual  satellites,  the  Air 
Force  has  inadvertently  exposed  itself  to  a  more  elusive  and  chronic  problem  of  constellation 
degradation.  Rather  than  dealing  with  satellite  degradation  proactively,  it  has  permitted  the  fleet 
to  age  beyond  its  optimal  design  life.  This  has  allowed  constellation  risk  to  accumulate  while 
shifting  greater  liability  to  the  future.  The  hallmark  of  a  system  with  rearranged  risks  is  a  need 
for  constant  vigilance,  monitoring,  and  adjustment  in  order  to  manage  and  mitigate  those 
escalating  risks. 34  This  is  precisely  the  situation  we  face  today. 

As  Peter  Senge  points  out  in  The  Fifth  Discipline,  slow,  gradual  processes  pose  the 
greatest  threats  to  organizations  because  humans  are  conditioned  to  focus  on  sudden  events  which 
pose  a  threat  to  our  survival.  We  are  maladapted  to  recognize  the  “longer-term  patterns  of 
change”  which  commonly  threaten  our  systems.35  Our  fixation  on  the  immediate  threat 
instinctively  focuses  our  attention  on  the  troublesome  satellite  du  jour,  but  we  fail  to  recognize 
the  underlying  pattern  of  escalating  trouble  across  the  constellation. 


32  Edward  Tenner,  Why  Things  Bite  Back  (New  York:  Alfred  A.  Knopf,  Inc.,  1996),  8. 

33  Ibid.,  48-58. 

34  Ibid.,  72,  104,  277. 

35  Peter  M.  Senge,  The  Fifth  Discipline:  The  Art  and  Practice  of  the  Learning  Organization  (New 
York:  Currency  Doubleday,  1990),  21-23. 
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Dietrich  Dorner  echoes  these  sentiments  in  his  book,  The  Logic  of  Failure,  in  which  he 
documents  common  errors  of  logic  which  can  lead  to  catastrophe.  “In  solving  problems  that 
involve  complex  dynamic  realities,”  he  writes,  “...we  must  think  about  problems  we  may  not 
have  at  the  moment  but  that  may  emerge  as  side  effects  of  our  actions.... [W]e  neglect  them 
because  we  don’t  have  those  problems  at  the  moment  and  therefore  are  not  suffering  from  their  ill 
effects.  In  short,  we  are  captives  of  the  moment.”36  Dorner  asserts  our  preoccupation  with  the 
pressing  problems  of  the  day  is  one  of  the  major  mistakes  we  make  in  dealing  with  complex 
systems.  It  is  the  gradual  deterioration  of  the  constellation  that  has  caused  the  “emerging  crisis” 
to  go  unnoticed  by  senior  Pentagon  leadership  until  only  recently. 

This  chapter  will  trace  the  history  of  the  constellation  deployment  and  prior 
replenishment  decisions  in  order  to  understand  the  context  of  the  current  situation.  Armed  with 
the  advantage  of  historical  perspective,  it  is  possible  to  identify  the  long-term  trends  and  the 
rearranging  of  risk  that  has  led  to  today’s  chronic  problem  of  multiple  fragile,  ailing  satellites. 

The  chapter  will  conclude  by  examining  the  constellation’s  current  status  and  the  near-term 
outlook  for  constellation  health. 

A  Short  History:  How  Did  We  Get  Here? 

The  chronology  of  the  GPS  program  can  be  traced  through  the  three  major  blocks,  or 
versions,  of  satellites  that  have  been  fielded.  The  block  I  satellites  were  developmental  satellites 
designed  to  provide  the  proof  of  system  concept.  After  this  concept  was  successfully 
demonstrated,  the  DoD  elected  to  construct  the  operational  constellation  with  improved  block  II 
satellites.  Since  1997,  these  aging  satellites  have  been  gradually  replaced  by  the  block  HR 
(replenishment)  satellites.  A  modernized  version  of  the  block  HR  with  enhanced  capabilities,  the 
IIR-M,  and  the  block  IIF  (follow-on)  satellites  are  being  built  and  are  waiting  their  turn  for  launch 

36  Dorner,  190. 
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in  2004. 37  A  radically  new  generation  of  satellite,  the  block  III,  is  currently  under  development 
with  projected  deployment  starting  in  2012. 38  The  modernized  birds  will  be  discussed  in  greater 
detail  in  Chapter  Three. 

The  block  I  satellites  were  research  and  development  satellites  designed  and  built  by 
Rockwell  International  to  test  and  refine  the  capability  of  the  system.  The  Rockwell  team 
designed,  tested,  and  launched  the  first  GPS  satellite  in  less  than  four  years. 39  The  first  GPS 
block  I  satellite  was  launched  on  22  February  1978,  and  within  the  calendar  year,  four  satellites 
were  in  orbit.  Over  the  course  of  the  next  seven  and  a  half  years,  a  total  of  eleven  satellites  were 
launched  using  a  launch-on-schedule  strategy,  with  one  satellite  lost  due  to  a  booster  failure.40 

The  block  I  satellites  exceeded  all  expectations  and  demonstrated  remarkable  longevity 
and  robustness  despite  being  developmental  satellites.  The  average  life  of  the  block  I  satellites 
reaching  orbit  was  8.9  years,  twice  the  mean  mission  duration  of  four  years.41  Four  satellites  even 
managed  to  survive  beyond  their  ten-year  anniversaries,  thus  doubling  their  five-year  design 
life.42  Eventually  the  developmental  satellites  would  fail  due  to  the  deterioration  of  their  atomic 
clocks  or  malfunctions  of  the  attitude  control  system,  but  not  before  they  convincingly 
demonstrated  the  concept  of  the  system.  Perhaps  the  greatest  legacy  of  the  block  I  satellites  was 
the  precedent  it  set  for  operational  longevity  and  for  exceeding  performance  standards.  With  the 
GPS  technology  successfully  proven,  the  system  was  now  prepared  to  advance  from  a 
developmental  program  to  an  operational  capability. 


37  Col.  Rick  Reaser,  GPS  Program  Update  (Brussels,  Belgium:  NATO  C3  Board  Subcommittee 
8),  Presentation,  7. 

38  Ibid.,  10. 

39  Dennis  M.  Galvin,  "History  of  the  GPS  Space  Segment  from  Block  I  to  the  New  Millennium," 
ION  GPS  1999,  14-17  September  1999,  Nashville,  TN,  1844. 

4(1  Air  Education  and  Training  Command,  534  TRS/DOBM,  "Payload  System  Operator  Course 
Student  Study  Guide:  Block  II  GPS  Navigation  Theory,  ”  1  May  1998,  2. 

41  Galvin,  1851. 

42  Air  Force  Materiel  Command,  Global  Positioning  System  Joint  Program  Office,  "Sust-Plan-001, 
Navstar  Global  Positioning  System  Maintenance  Plan  for  the  Space  and  Control  Segments  (Draft)," 
(Peterson  Air  Force  Base,  CO:  Detachment  11,  Space  and  Missile  Systems  Center,  15  December  2000),  4. 
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The  path  toward  a  fully  operational  system,  however,  was  not  smooth.  The  acquisition 
program  for  the  production  satellites,  dubbed  the  block  II,  had  to  be  significantly  restructured  in 
1979  due  to  severe  funding  cuts.  The  system's  forecasted  budget  for  1981  to  1986  was  slashed 
by  nearly  30  percent.43  Two  major  factors  contributed  to  the  lack  of  financial  support  for  GPS. 
First,  GPS  was  categorized  as  a  support  system  as  opposed  to  a  weapon  system.  Because  it  did 
not  have  a  history  of  well-defined  operational  concepts,  its  military  utility  to  the  armed  services 
was  not  as  obvious  as  other  well-established  weapons  systems.  No  one  could  have  predicted 
twenty-five  years  ago  the  revolutionary  changes  GPS  would  spawn.  The  untried  navigation 
combat  support  system,  although  promising,  lost  out  to  seemingly  more  pressing  warfighting 
needs.  Secondly,  the  constellation’s  status  as  a  joint  program  retarded  strong  financial  support 
from  any  single  service.  The  services  were  not  eager  to  spend  their  own  scarce  resources  on  a 
program  that  would  benefit  everyone.  Without  a  strong  sponsor  to  shepherd  it  through  the 
sometimes- cutthroat  budgeting  process,  the  system  was  zeroed  out  during  budget  negotiations  in 
1980,  1981,  and  1982.  The  program  was  rescued  only  after  the  Office  of  the  Secretary  of 
Defense  directed  that  its  funding  be  restored.44 

With  funding  in  place  for  the  time  being,  Rockwell  was  awarded  the  contract  in 
September  1983  to  build  and  launch  twenty-eight  block  II  satellites.  The  block  II  satellites 
incorporate  significant  improvements  over  the  block  I,  including  enhanced  radiation  hardening  to 
improve  reliability  and  survivability.  These  enhancements  helped  to  increase  the  specification 
design  life  from  6  years  to  7.5  years.45  In  March  of  1984,  it  was  decided  to  make  further 
modifications  to  the  configuration  of  the  tenth  and  all  subsequent  block  II  satellites.  These 


43 

44 

45 


Peter  Grier,  "The  Sensational  Signal,"  Air  Force  Magazine ,  February  2003,  68-69. 

Ibid. 

SS-GPS-300E,  System  Specification  for  the  Navstar  Global  Positioning  System,  30  January 
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satellites,  designated  the  block  IIA,  have  enhanced  payload  survivability  capabilities  and 
incorporate  improved  sensors  into  the  nuclear  detonation  detection  payload.46 

The  initial  deployment  of  the  block  II  was  further  delayed  in  1986  as  a  result  of  the  Space 
Shuttle  Challenger  accident.  The  DoD  had  earlier  designated  the  Space  Shuttle  as  the  principal 
launch  vehicle  for  all  Air  Force  space  missions.47  As  the  only  planned  launch  vehicle  for  GPS 
satellites  at  that  time,  the  loss  of  the  shuttle  caused  a  twenty-four  month  delay  in  the  scheduled 
launch  of  the  block  IIs.  During  the  moratorium  on  shuttle  launches,  it  was  decided  to  modify  the 
new  satellites  to  make  them  compatible  with  the  Delta  II  launch  vehicle. 48  The  first  block  II 
satellite,  satellite  vehicle  number  14  (SVN  14),  was  eventually  launched  aboard  a  Delta  II  in 
February  1989  and  was  available  for  operational  use  two  months  later. 

Following  the  successful  launch  of  SVN  14,  the  Air  Force  adopted  an  aggressive  Launch 
To  Deploy  (LTD)  strategy  with  launches  scheduled  approximately  every  two  to  three  months  to 
rapidly  constitute  the  new  constellation.  Within  less  than  two  years  of  SVN  14  reaching  orbit,  a 
flurry  of  GPS  launches  from  Cape  Canaveral  brought  nine  more  satellites  into  service.49 

By  early  August  1990  as  Iraqi  armored  divisions  were  rolling  into  Kuwait,  the 
constellation  was  still  an  experimental  system  with  only  thirteen  satellites  available,  including  six 
of  the  older  block  I  satellites.  The  Air  Force,  however,  possessed  no  satellite  production  or 
launch  surge  capability  to  accelerate  the  buildup  of  the  constellation.  Consequently,  the  war  had 
little  impact  on  the  launch  schedule.50  During  the  seven-month  period  of  Operations  Desert 


Galvin,  1 844.;  Pace  and  others,  244.  Block  IIA  satellites  have  the  capability  to  operate  for  1 80 
days  without  control  segment  intervention.  The  block  I  and  II  satellites  required  intervention  at  least  every 
3.5  days. 

47  Pace  and  others,  243. 

48  Ibid. 


49  Joint  Program  Office,  Navstar  GPS  User  Equipment  Introduction  (September  1996),  1-21. 

50  Rip  and  Hasik,  132. 
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Shield  and  Desert  Storm,  the  U.S.  launched  three  previously -scheduled  satellites  and  placed  them 
in  orbital  positions  to  provide  optimal  GPS  coverage  over  the  region.51 

In  late  1990  two  serious  satellite  problems  were  discovered  which  threatened  the  entire 
fleet.  The  first  problem  was  an  attitude  control  anomaly  that  posed  a  threat  to  all  previously 
launched  block  II  satellites.  The  other  problem  was  a  design  deficiency  in  the  electrical  power 
system  of  the  new  block  IIA  satellites,  which  were  just  being  delivered  into  the  launch  sequence. 
A  decision  was  made  to  delay  launches  until  these  two  issues  could  be  resolved.  The  deployment 
of  new  satellites  was  interrupted  for  approximately  fifteen  months  while  a  solution  was  sought. 

After  both  of  these  issues  were  resolved  in  early  1992,  the  launch  schedule  resumed  with 
new  vigor.  A  string  of  thirteen  satellites,  over  half  the  constellation,  was  successfully  placed  into 
service  within  twenty-six  months.  A  full  compliment  of  twenty-four  satellites  was  finally 
achieved,  and  Initial  Operational  Capability  (IOC)  was  announced  for  the  system  in  December 
1993.  The  IOC  notification  signified  GPS  was  capable  of  sustaining  the  civil  GPS  service  at  the 
required  performance  levels  on  a  continuous,  worldwide  basis. 52  Because  the  system  still 
contained  some  of  the  older  and  less  capable  block  I  satellites,  the  launch  rate  continued  unabated 
until  March  1994  when  the  twenty-fourth  block  II/IIA  completed  the  constellation.  Seventeen 
months  later,  Air  Force  Space  Command  formally  declared  Full  Operational  Capability  (FOC)  for 
GPS,  meaning  the  constellation  had  reached  full  military  functionality.53 

Just  as  the  constellation  was  in  a  state  of  transition  from  an  experimental  system  to  a  fully 
operational  one,  so,  too,  was  the  launch  strategy  in  flux.  Immediately  following  the  declaration 
of  FOC,  the  launch  rate  immediately  tapered  off,  with  no  launches  for  the  next  two  years.  With  a 
full  set  of  satellites  on  orbit,  the  launch  strategy  shifted  from  Launch  To  Deploy  (LTD)  to  Launch 


51  Ibid. 

2  Pace  and  others,  265. 
53  Ibid.,  246. 


16 


To  Sustain  (LTS).  LTS  is  a  strategy  to  replace  satellites  predicted  to  fail  or  that  fail  abruptly.54 
LTS  may  be  implemented  in  one  of  two  ways:  launches  may  be  proactively  scheduled  based  on 
predicted  satellite  failure  (launch-on-schedule)  or  they  may  be  scheduled  in  response  to  an  abrupt 
satellite  failure  (launch-on- failure). 

The  original  plan  called  for  a  launch-on-schedule  strategy  with  replacement  satellites 
launched  about  every  three  months.  55  It  was  thought  that  this  routine  would  ensure  twenty-four 
healthy  satellites  most  of  the  time,  with  the  constellation  very  rarely  dipping  to  the  minimum 
twenty-one  satellites.  The  strategy  of  routine,  regularly  scheduled  launches,  however,  was  never 
implemented.  Instead,  a  greater  acceptance  of  operational  risk  prevailed  because  ensuing 
circumstances  encouraged  a  policy  of  maximizing  individual  satellite  life. 

By  1996  it  had  been  seven  years  since  the  first  block  II  satellites  had  been  launched,  and 
they  were  already  approaching  their  7.5-year  design  life.  The  first  two  block  II  satellites  failed  in 
1996,  bringing  the  satellite  count  to  twenty-five,  and  several  satellites  experienced  attitude  control 
component  failures.56  There  was  “great  concern”  the  armada  of  satellites  would  drop  below  the 
mandated  level  of  twenty-four  satellites  within  three  to  six  years,  based  on  sustainment  studies 
which  assumed  the  satellites  would  fail  (on  average)  at  the  same  rate  they  were  launched.57  The 
predicted  spike  in  failures  was  a  reflection  of  the  twenty-two  satellites  launched  during 
constellation  deployment  in  1989-90  and  1992-93.  The  minutes  from  a  1996  Constellation 
Sustainment  Assessment  Team  (CSAT),  a  quarterly  forum  to  evaluate  the  condition  of  the 
constellation  and  to  make  launch  recommendations,  read:  “Even  if  every  current  launch 

54  Air  Force  Space  Command,  Concept  of  Operations ,  3-18. 

55  Colonel  G.B.  Green,  "The  GPS  21  Primary  Satellite  Constellation,"  NAVIGATION:  Journal  of 
The  Institute  of  Navigation  36,  no.  1  (1989):  10. 

56  Capt  McDowell.  "Point  Paper  on  GPS  Constellation  Status  Assessment  Team  (CSAT) 

Minutes,"  (2  SOPS/DOUAS,  18  June  1996).  memo. 

57  Steven  C.  Fisher  and  Kamran  Ghassemi,  "GPS  IIF-the  Next  Generation,"  Proceedings  of  the 
IEEE  87,  no.  1  (1999):  25. 
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opportunity  is  used,  there  is  still  a  50%  probability  of  dropping  below  24  satellites  and  a  10% 
chance  of  dropping  below  21  satellites  in  the  1999  to  2003  timeframe  based  on  a  [life  expectancy] 
of  7.5  years.”58  The  most  expedient  way  to  solve  this  dilemma  was  to  sustain  the  on-orbit 
satellites  as  long  as  possible.  In  short,  the  emerging  replenishment  strategy  was  to  string  out 
launches  so  satellites  would  be  available  to  fill  the  predicted  satellite  gap.  Several  launches  were 
cancelled  or  delayed  in  the  1998-2001  time  frame,  even  though  in  one  case  the  probability  of 
maintaining  twenty-four  satellites  dropped  below  eighty  percent  and  in  another  instance  it 
dropped  to  sixty  percent.59 

By  January  1997  the  next  generation  of  satellite,  the  block  HR  (replenishment),  was 
prepared  to  launch.  This  replenishment  program  has  been  started  in  1988  while  the  block  II 
satellites  were  still  in  production.  Martin  Marietta  was  awarded  the  contract  the  following  year  to 
build  twenty-one  satellites. 60  These  satellites  incorporated  several  enhancements  over  the  earlier 
satellite  versions,  including  more  accurate  atomic  clocks,  on-orbit  software  reprogrammability, 
extended  survivability,  and  reduced  operations  support  requirements.61  The  first  launch  ended 
just  seconds  after  liftoff  in  a  fiery  explosion  that  destroyed  the  satellite.  The  next  launch  attempt 
six  months  later  successfully  placed  SVN  43  into  orbit.  The  newest  spacecraft  underwent 
extensive  testing  which  unearthed  some  abnormalities  with  its  time  keeping  system,  its  extended 
survivability  capabilities,  and  it  nuclear  detonation  detection  payload.  This  halted  HR  launches 
for  twenty-eight  months  while  a  fix  could  be  designed  and  tested. 


5S  McDowell,  memo. 

59  Col.  Henry  W.  Poburka,  Jr.,  "Global  Positioning  System  (GPS)  Constellation  Sustainment 
Assessment  Team  (CSAT)  Report,"  23  March  1998,  Vandenberg  AFB,  CA,  memo.;  and  Joint  Program 
Office,  JPO  CSAT.  Presentation  to  CSAT  at  Vandenberg  AFB,  CA,  April  2001. 

60  Lt  Col  C.  McGinn,  Capt  S.  Rajotte,  and  D.  Latterman,  "Global  Positioning  System  (GPS) 
Modernization,"  32nd  Annual  Precise  Time  and  Time  Interval  (PTTI)  Meeting ,  28-30  November  2000, 
Reston,  VA,  403. 

61  Willard  Marquis,  "Increased  Navigation  Performance  from  GPS  Block  HR,"  ION  GPS  2002, 
24-27  September  2002,  Portland,  OR,  1230-1232. 
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In  1998  Vice  President  Gore  announced  a  major  initiative  that  promoted  “enhancements 
to  the  Global  Positioning  System  that  will  benefit  civilian  users  worldwide.”62  The  service 
enhancements  included  broadcasting  a  second  and  third  civil  GPS  signal,  adding  new  military 
codes,  and  increasing  signal  strength.  These  upgrades  will  provide  much  needed  civil  signal 
redundancy,  improved  positioning  accuracy,  and  increased  resistance  to  interference.6’  The  Air 
Force  planned  to  retrofit  up  to  twelve  HR  satellites  with  the  new  capabilities. 64  The  final  number 
of  modernized  satellites,  designated  block  IIR-M,  would  depend  on  the  HR  launch  rate.  The 
slower  the  launch  rate,  the  greater  the  number  of  block  HR  satellites  available  for  the 
modernization  retrofit.  Although  the  Air  Force  stated  constellation  sustainment  was  the  first 
priority,  there  was  an  undeniable  institutional  incentive  to  delay  launches  in  an  effort  to 
modernize  as  many  satellites  as  possible. 

Also  contributing  to  the  delayed  launch  schedule  were  declining  acquisition  budgets 
which  put  a  tight  squeeze  on  national  security  space  programs.  According  to  a  report  authored  by 
the  Defense  Science  Board  and  the  Air  Force  Scientific  Advisory  Board,  the  budgetary 
environment  during  the  1990s  created  a  space  acquisition  culture  which  emphasized  cost  rather 
than  mission  success  as  the  primary  objective.  The  result  of  this  cultural  bias  was  increased 
acceptance  of  risk  to  mission.65  Although  the  report  specifically  studied  the  acquisition  of  new 
space  programs  and  did  not  address  their  sustainment  directly,  the  organization  responsible  for 
acquiring  Air  Force  space  programs,  the  Space  and  Missile  Systems  Center,  is  also  responsible 
for  their  sustainment.  The  constrained  funding  environment  was  not  singularly  limited  to  the 

62  McGinn,  Rajotte,  and  Lattemian,  404. 

63  Michael  Shaw,  Kanwaljit  Sandhoo,  and  David  Turner,  'Modernization  of  the  Global  Positioning 
System,"  32nd  Annual  Precise  Time  and  Time  Interx’al  (PTTI)  Meeting ,  28-30  November  2000,  Reston, 
VA,  18. 

64  McGinn,  Rajotte,  and  Latterman,  403. 

65  Report  of  the  Defense  Science  Board  /Air  Force  Scientific  Advisory  Board  Joint  Task  Force  on 
Acquisition  of  National  Security  Space  Programs  (Washington,  D.C.:  Office  of  the  Under  Secretary  of 
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acquisition  phase;  sustainment  was  also  effected.  Moreover,  the  issues  of  acquisition  and 
sustainment  funding  were  tightly  coupled,  especially  in  regard  to  the  block  HR  modernization 
program.  It  is  reasonable  to  assume  the  same  funding  pressures  that  produced  a  culture  of  risk 
taking  during  the  acquisition  of  new  capabilities  was  also  at  work  for  the  less  glamorous 
sustainment  phase  of  GPS. 

Another  significant  factor  encouraging  the  acceptance  of  risk  during  satellite  sustainment 
is  the  “peculiar  aspects  associated  with  space  system  development  and  production.”66  Space 
programs  have  a  different  funding  curve  than  most  typical  weapon  systems.  A  space  system 
spends  most  of  its  budget  early  in  its  life  cycle  during  development  and  well  before  deployment. 
Consequently  the  sustainment  phase  of  a  space  system  accounts  for  a  much  smaller  percentage  of 
the  system's  life  cycle  costs  than  do  most  other  systems.67  Moreover,  the  sustainment  costs  for  an 
on-orbit  satellite  are  based  on  relatively  fixed  overhead  infrastructure  and  personnel  costs.  The 
operations  and  maintenance  (O&M)  costs  for  the  control  segment  and  the  expenses  for  sustaining 
the  satellite  operators  and  contractor  engineering  support  remain  fixed  regardless  of  constellation 
size  or  health.  Because  these  costs  remain  stable  throughout  a  satellite’s  life,  there  is  no  direct 
economic  incentive  to  proactively  replace  an  ailing  satellite  before  it  fails. 

Now  contrast  satellites  with  an  aging  fleet  of  aircraft.  Older  aircraft  need  extensive 
periodic  inspections  and  depot-level  maintenance  to  maintain  aircraft  operational  rates.  Rising 
O&M  costs  impose  escalating  economic  pressure  to  replace  aircraft  before  they  become 
prohibitively  expensive.  The  optimal  replacement  interval  for  an  aircraft  shortens  as  the  growth 


66  Elizabeth  Rees,  "Air  Force,  GAO  Officials  Wrangle  over  New  Space  Acquisition  Policy, " 
Inside  the  Air  Force  (21  November  2003)  in  [e-mail  newsletter]  CGSC  Space  News  (Ft  Leavenworth,  KS: 
Command  and  General  Staff  College,  25  November  2003). 

67  SSgt  Melanie  Streeter,  "Space- Acquisitions  Policy  Changes,"  Air  Force  Print  News  (20 
November  2003)  in  [e-mail  newsletter]  CGSC  Space  News  (Ft  Leavenworth,  KS:  Command  and  General 
Staff  College,  25  November  2003). 
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rate  of  O&M  costs  increases.68  Consequently,  economic  pressure  helps  to  curb  the  overall 
operational  risk  of  an  aging  aircraft.  Periodic  inspections  also  provide  the  added  benefit  of  giving 
decision  makers  an  unambiguous  source  of  information  on  the  health  of  the  aircraft,  thereby 
further  making  the  case  for  proactive  replacement.  In  contrast,  the  inaccessibility  of  satellites 
limits  the  knowledge  of  satellite  health  to  a  thin  stream  of  telemetry  data.  Latent  satellite 
deficiencies  remain  hidden  and  uncertain,  and  operational  risk  is  permitted  to  accumulate. 

The  most  significant  reason  replenishment  launches  in  the  late  1990s  and  the  new 
millenium  were  delayed  was  simply  because  the  block  II/IIA  satellites  were  continuing  to 
outperform  their  accuracy  and  availability  requirements  and  were  far  outliving  their  original 
design  lives  of  7.5  years.  The  average  life  expectancy  for  a  block  II/IIA  satellite  in  late  1999  had 
grown  to  over  8.5  years  and  the  number  of  on-orbit  satellites  had  ballooned  to  twenty -eight. 69 
The  remarkable  success  of  GPS  over  the  past  decade  had  helped  to  disguise  the  underlying  cracks 
in  the  system.  Ironically,  this  success  may  have  planted  the  seeds  for  possible  future  failure. 

With  satellites  living  longer,  there  was  mounting  pressure  to  reduce  the  number  of 
replenishment  launches  due  to  limitations  in  the  control  segment. 70  The  ground  control  segment 
can  command  and  control  a  maximum  of  thirty  on-orbit  satellites.71  Once  that  ceiling  is  reached, 
launches  must  be  postponed  until  either  a  satellite  fails  or  one  is  proactively  disposed.  It  became 
increasingly  difficult  to  justify  replenishment  launches  while  there  were  “excess”  satellites  on 
orbit,  especially  if  it  meant  a  satellite  had  to  be  disposed  prior  to  launch.  At  face  value  this 
seemed  wasteful  and  illogical.  An  emphasis  on  extending  satellite  life  became  the  prime 


6S  Victoria  A.  Greenfield  and  David  M.  Persselin,  An  Economic  Framework  for  Evaluating 
Military  Aircraft  Replacement  (Santa  Monica,  CA:  RAND,  2002),  xi. 

69  lLt  John  J.  Losinski,  "Operational  Response  to  an  Aging  Global  Positioning  System 
Constellation,"  ION  GPS  2000 ,  19-22  September  2000,  Salt  Lake  City,  UT,  2543.;  and  Major  Mike  Mason, 
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directive,  sometimes  even  at  the  expense  of  navigation  accuracy.72  While  the  practice  of  retiring 
functional  aircraft  is  well  established  within  the  Air  Force,73  the  idea  of  replacing  an  operational 
satellite,  no  matter  how  old  or  crippled,  is  still  considered  wasteful  and  is  not  well  accepted.74 

At  this  juncture,  numerous  orbital  planes  had  at  least  one  satellite  beyond  its  design  life 
operating  on  a  redundant,  backup  system.  A  common  technique  was  to  buttress  an  aging,  fragile 
satellite  with  a  new  satellite  in  order  to  mitigate  the  impact  of  a  satellite  failure.75  With  so  many 
weak  satellites,  however,  there  were  not  enough  backups  available  to  cover  them  all.  The 
difficulty  was  no  longer  determining  whether  a  launch  was  needed,  but  which  satellite  should  be 
replaced  first.  Without  a  clear  prediction  of  which  satellite  would  fail  next,  the  Air  Force 
cancelled  launches  in  2000  and  2001  because  of  “no  operational  need”  despite  the  fact  there  was 
a  forty  percent  chance  three  satellites  would  fail  within  the  next  twelve  months. 76  There  was 
growing  concern  a  satellite  might  be  launched  into  the  “wrong”  orbital  plane  and  be  unavailable 
to  replace  a  failed  satellite  in  an  unexpected  plane.  As  a  result,  a  launch-on-failure  satellite 
replenishment  strategy  prevailed. 


Current  Constellation  Status 


All  the  while  constellation  risk  continued  to  mount.  The  tradeoff  for  delaying  launches 
through  2001  was  greater  reliance  on  launches  in  later  years.  Conservative  estimates  in  2002 


72  Capt  Michael  Violet  and  others,  "Navigation  Accuracy  or  Satellite  Health?  Controlling 
Momentum  on  Aging  GPS  Satellites,"  ION  GPS  '99,  14-17  September  1999,  Nashville,  TN,  2273. 

77  The  Aerospace  Maintenance  and  Regeneration  Center  at  Davis  Monthan  Air  Force  Base  in 
Tucson,  AZ  is  a  testament  to  the  long  standing  practice  of  retiring  aircraft  before  they  become  an 
operational  risk  or  technologically  obsolete.  Better  known  as  the  “boneyard,”  it  is  home  to  4,500  aircraft. 

74  Losinski,  2543.;  and  Air  Force  Materiel  Command,  "Aerospace  Maintenance  and  Regeneration 
Center"  [Internet]  (2003,  accessed  1  March  2004);  available  from 
http://www.dm.af.mil/AMARC/history.html. 

75  Capt  Jim  Smith  and  Lt  Brian  McFarland,  GPS  Constellation  Sustainment.  Presentation  to  CSAT 
at  Vandenberg  AFB,  CA,  May  2002,  3. 

76  Losinski,  2544.;Maj  Gen  William  R.  Looney  III,  "Results  of  GPS  Constellation  Sustainment 
Assessment  Team  (CSAT),"  (2001)  memo.;  GPS  Joint  Program  Office,  GPS  JPO  CSAT  Recommendation  - 
May  2002  Launch.  Presentation  to  CSAT  at  Vandenberg  AFB,  CA,  May  2002;  and  Capt  Donald  A. 
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predicted  eighteen  satellite  failures  by  the  end  of  2006,  but  there  were  only  sixteen  launches 
scheduled  during  the  same  period.77  However  the  exact  failure  distribution  was  unpredictable  and 
likely  uneven.  While  few  failures  were  predicted  in  2002  and  2003,  it  was  possible  for  a  spike  in 
failures  in  later  years  to  exceed  the  nominal  maximum  rate  of  four  launches  per  year.78 
Moreover,  launches  generally  cannot  occur  on  demand  because  there  is  significant  competition 
for  launch  pad  availability.  Assuming  a  launch  pad  and  satellite  are  readily  available  for  launch, 
it  nominally  takes  140  days  from  the  receipt  of  the  launch  order  to  have  a  satellite  on  orbit 
broadcasting  a  usable  signal. 79  Consequently,  launches  need  to  occur  before  actual  failures,  and 
additional  satellites  should  be  incorporated  into  the  constellation  to  increase  its  robustness  against 
unforeseen  failures. 

Today  the  constellation  is  the  largest  and  oldest  it  has  ever  been.  As  of  November  2003, 
the  twenty-eight  operational  satellites  have  an  average  age  of  8.4  years,  far  exceeding  their  design 
life  of  7.5  years.  Twelve  satellites  are  operating  on  a  redundant,  backup  component  and  are  a 
single  component  failure  away  from  a  complete  loss  of  the  navigation  mission.  In  addition,  eight 
satellites  are  only  one  component  failure  from  a  complete  loss  of  the  spacecraft  bus. 80 

There  are  signs  the  block  II  satellites  may  be  reaching  the  end  of  their  life  expectancy. 

The  average  life  expectancy  each  block  of  satellite,  officially  termed  the  mean  mission  duration 
(MMD),  is  updated  semi-annually  based  on  the  previous  six-month's  performance  and 
component  failures.  Component  failures  in  2003  shortened  the  average  life  expectancy  of  block 


Daugherty  memo  to  COMAFSPACE,  "GPS  Constellation  Sustainment  and  Assessment  Team  (CSAT) 
Minutes,"  (Vandenberg  AFB  CA:  n.d.). 

77  Smith  and  McFarland,  2. 

7S  Major  David  E.  Hook,  OCS  Launch  Process.  Presentation  to  CSAT  at  Vandenberg  AFB,  CA, 

18  January  2002,  5,  9 ;  and  Smith  and  McFarland,  2. 

79  Hook,  5,  9. 

Sl)  Capt  Patrick  Long  and  Capt  Daniel  Lid,  Navstar  Global  Positioning  System  CSAT.  Presentation 
to  CSAT  at  Vandenberg  AFB,  CA,  19  November  2003. 
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II  satellites  from  a  peak  of  9.90  years  in  November  2002  to  9.65  years  in  October  2003.  Block 
IIA  satellites  had  a  similar  drop  from  10.82  years  to  10.32  years.  The  MMD  and  the  launch 
schedule  are  input  into  a  Monte  Carlo  analysis  to  generate  a  forecast  of  the  probability  of 
maintaining  twenty-four  operational  satellites.  This  forecast  forms  the  basis  for  scheduling 
replenishment  launches.81 


Figure  1.  Constellation  Status  1979-2004 


The  decrease  in  life  expectancy  in  the  block  II  and  IIA  satellites  by  a  mere  three  and  six 
months,  respectively,  had  a  significant  impact  on  sustainment  predictions.  Figure  2  shows  the 
probability  of  maintaining  twenty-four  satellites  drops  to  65  percent  in  fiscal  year  2007,  thereby 
violating  the  95  percent  satellite  availability  requirement.  The  strategy  of  maximizing  satellite 
life  by  postponing  launches  has  reduced  the  available  “slack”  in  the  system,  thereby  making  the 
constellation  very  sensitive  to  changes  in  MMD  predictions.  It  is  similarly  susceptible  to 
unforeseen  “frictions”  such  as  a  launch  failure  or  a  significant  satellite  design  error  which 
imposes  an  unexpected  launch  delay  while  a  resolution  is  worked.  Although  this  satellite 
availability  deficiency  will  likely  be  resolved  by  shifting  launches  a  few  months  earlier,  it  should 

81  Mason,  16,23. 
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nevertheless  send  a  clear  warning  signal  to  decision  makers  that  the  constellation  is  in  a  very 
precarious  condition. 


Figure  2.  Predicted  Satellite  Availability  from  November  2003 82 


Perhaps  more  startling  is  the  probability  of  multiple  satellite  failures  within  the  next 
twelve  months.  Figure  3  on  the  next  page  shows  a  twenty-nine  percent  chance  of  five  satellite 
failures  within  the  next  twelve  months,  and  a  fifty-five  percent  chance  of  four  failures.  There  is 
simply  no  margin  for  canceling  future  satellite  launches.  While  a  single  satellite  failure  within  a 
fully  populated  constellation  is  manageable,  the  interaction  of  multiple  satellite  failures  can 
degrade  GPS  service  availability  and  reduce  positioning  accuracy  for  limited  geographic  areas. 
The  potential  user  impacts  caused  by  a  satellite  failure  will  be  investigated  in  the  next  chapter. 
The  history  of  the  GPS  space  segment  can  be  characterized  as  one  of  incredible  achievement.  No 
less  amazing  has  been  the  remarkable  efforts  of  the  dedicated  space  operators  and  engineers 


82  Ibid.,  4.  This  analysis  is  based  on  the  official  launch  schedule  and  the  proposed  October  2003 
MMDs.  At  the  time  of  the  analysis,  the  proposed  MMDs  had  not  yet  been  approved  and  were  therefore 
unofficial. 
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tasked  to  keep  the  constellation  flying.  The  GPS  community  has  come  to  expect--  and  rely  on— 
these  remarkable  efforts  to  maintain  uninterrupted  service  that  far  exceeds  the  standard.  Today 
one  finds  a  constellation  populated  with  fragile  satellites  operating  with  software  patches  and 
operational  work-arounds.  Each  satellite  has  its  own  unique  hardware  and  software  configuration 
requiring  tailored  support  requirements  and  specific  handling  instructions.  Each  satellite,  in 
effect,  has  become  its  own  engineering  project.  These  half  measures  belie  the  importance  of  a 
global  utility  of  GPS’  stature. 


Probability  of  Multiple  GPS  Failures 

November  2003  (April  2003  Reliability) 

(Include*  million  luceel*  fwllR-10  and  IIR-11  SVN-22  Out-d-Servlce) 
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Figure  3.  Probability  of  Multiple  Failures  from  November  2003 83 

The  very  success  of  GPS  has  helped  to  conceal  the  emerging  crisis  which  looms  on  the 
horizon.  This  “failure  of  success”84  has  severely  reduced  the  margins  from  the  current  launch 
schedule  and  has  inadvertently  led  to  a  chronic  constellation  problem  of  ailing  spacecraft  of 
questionable  reliability.  In  addition,  history  demonstrates  that  numerous  little  “frictions”  in  the 
form  of  insufficient  and  unstable  funding,  programmatic  scheduling  delays,  catastrophic  launch 
failures,  unforeseen  launch  slippage,  and  unexpected  satellite  anomalies  are  an  ever-present 

83  Capt  Mike  Perz,  Navstar  Global  Positioning  System  CSAT.  Presentation  to  CSAT  at 
Vandenberg  AFB,  CA,  19  November  2003,  8. 

84  Tenner,  48-49. 
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element  of  constellation  management.  The  inability  to  precisely  predict  satellite  failures  coupled 


with  the  long  lead  times  needed  to  build  replacement  satellites  further  complicates  the  problem. 
Sustainment  plans  must  contain  adequate  slack  and  robustness  to  recover  from  these  inevitable 
frictions  and  uncertainties.  At  the  heart  of  satellite  replenishment  decisions  lies  the  level  of  risk 
that  must  be  deemed  acceptable  to  mission  assurance.  The  next  chapter  will  investigate  the  risks 
to  military  and  civil  users  at  both  the  satellite  and  system  level  and  the  opportunity  costs  that  have 
been  borne  due  to  delayed  modernization  schedules. 
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CHAPTER  THREE:  VULNERABILITIES  AND  COSTS 


In  the  old  days,  the  tools  of  farming,  manufacture,  business  management,  and 
communication  were  simple.  Breakdowns  were  frequent,  but  repairs  could  be  made  without 
calling  the  plumber,  the  electrician,  the  computer  scientist— or  the  accountants  and  the 
investment  advisors.  Failure  in  one  area  seldom  had  direct  impact  on  another.  Today,  the 
tools  we  use  are  complex,  and  breakdowns  can  be  catastrophic,  with  far  reaching 
consequences.  We  must  be  constantly  aware  of  the  likelihood  of  malfunctions  and  errors. 

Peter  L.  Bernstein,  Against  The  Odds:  The  Remarkable  Story  of  Risk 85 

We  are  loath  to  let  others  do  unto  us  what  we  happily  do  to  ourselves. 

Chauncey  Starr,  Perspectives  on  Benefit-Risk  Decision  Making  6 


Since  GPS  made  its  military  debut  in  the  Gulf  War,  it  has  been  imbedded  into  nearly 
every  U.S.  military  platform  and  has  come  to  perform  a  central,  integrating  role  for  most  of  the 
nation’s  critical  civilian  infrastructure.  One  simple  measure  of  the  growing  importance  of  GPS  to 
U.S.  military  operations  is  the  number  of  GPS  receivers  in  the  inventory.  Prior  to  the  start  of 
Desert  Shield,  the  U.S.  Army  had  only  a  few  hundred  handheld  military  GPS  receivers. 87  In 
contrast,  the  U.S.  Air  Force  and  the  Navy  expect  to  have  about  7,000  GPS-equipped  platforms  in 
service  by  2006,  with  the  U.S.  Army  deploying  about  30,000  units.  By  then  the  three  services 
will  have  fielded  a  total  of  more  than  500,000  weapons  using  some  form  of  GPS  for  guidance.88 
The  loss  of  GPS  could  have  a  devastating  effect  on  the  combat  power  of  these  platforms  and  on 
joint  operations  in  general. 89 

Critical  civilian  infrastructure,  seeking  the  increased  efficiencies  made  possible  by  GPS, 
has  also  developed  a  reliance  on  GPS  that  can  lead  to  serious  consequences  if  the  service  is 


8:1  Peter  L.  Bernstein,  Against  the  Odds:  The  Remarkable  Story  of  Risk  (New  York:  John  Wiley  & 
Sons,  Inc.,  1998),  2. 

86  Chauncey  Starr,  Perspectives  on  Benefit-Risk  Decision  Making  (Washington,  D.C.:  National 
Academy  of  Engineering,  1972),  30. 

87  Rip  and  Hasik,  135. 

88  David  Foxwell  and  Mark  Hewish,  "GPS:  Is  It  Lulling  the  Military  into  a  False  Sense  of 
Security?,"  Jane's  International  Defense  Review ,  September  1998,  33. 

89  John  G.  Roos,  "High  Stakes  Contract  'Winner  Takes  All’  Outcome  Unlikely  from  Air  Force's 
GPS  Satellite  Plan,"  Armed  Forces  Journal  International,  October  1995,  64. 
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disrupted  and  the  applications  are  not  prepared  with  mitigating  equipment  and  procedures. 90  As 
the  “...essential  services  that  underpin  our  society,”91  critical  infrastructures  are  vital  to  the 
nation’s  security,  economy,  and  survival.  A  reliable  GPS  timing  signal  is  essential  to  the  efficient 
operation  of  geographically  distributed  infrastructures  such  as  telecommunications  and  electrical 
power  systems. 

GPS  has  also  spawned  a  multi-billion  dollar  international  economic  market  representing 
billions  of  dollars  in  annual  tax  revenue.92  The  synergistic  combination  of  shrinking  receiver 
size,  declining  receiver  prices,  and  improved  constellation  performance  has  created  a  diverse, 
dynamic,  and  rapidly  expanding  commercial  market  for  GPS  applications. 93  The  Commerce 
Department  reported  global  sales  for  GPS  receivers  were  $867  million  in  1994. 94  A  recent  report 
forecasts  the  world  market  for  GPS  equipment  in  2008  will  grow  to  either  $34  billion  as  a 
moderate  figure  or  to  a  more  optimistic  $41  billion,  depending  on  the  world  economic  recovery.95 
Similarly,  the  number  of  commercial  users  in  the  United  States  has  exploded  from  more  than 
500,000  in  1995  to  over  20  million  in  2002. 96  GPS  is  on  par  with  the  Internet  as  one  of  the  most 
successful  dual-use  technologies  in  history.97 


90  John  A.  Volpe  National  Transportation  Systems  Center,  Vulnerability  Assessment  of  the 
Transportation  Infrastructure  Relying  on  the  Global  Positioning  System  (Office  of  the  Assistant  Secretary 
for  Transportation  Policy,  U.S.  Department  of  Transportation,  2001),  5. 

1  Theresa  Brown,  "Assessing  Infrastructure  Interdependencies:  The  Challenge  of  Risk  Analysis 
for  Complex  Adaptive  Systems,"  A  Workshop  on  Mitigating  the  Vulnerability  of  Critical  Infrastructure  to 
Catastrophic  Failures,  10-11  September  2001.  Alexandria,  VA,  1. 

92  Bruce  D.  Nordwall.  "GNSS  at  a  Crossroads,"  Aviation  &  Space  Technology,  8  September  2003, 
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The  Global  Positioning  System:  Charting  the  Future  Summary  Report  (National  Academy  of 
Public  Administration  and  National  Research  Council,  1995),  9. 

94  John  C.  Dailey,  "Space  and  Oceans:  Can  They  Be  Controlled?,"  in  Strategic  Assessment  1999: 
Priorities  for  a  Turbulent  World  (Washington  D.C.:  National  Defense  University,  1999),  302. 

95  Allied  Business  Intelligence  Research,  "GPS  World  Markets:  Opportunities  for  Equipment  and 
IC  Suppliers"  [Internet]  (accessed  31  December  2003)  available  from 
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A  dual  use  technology  is  one  which  benefits  both  military  and  civilian  applications. 
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The  dynamic  and  rapidly  expanding  nature  of  GPS  makes  its  management  that  much 
more  difficult.  Constellation  management  policies  must  keep  pace  with  GPS’  exploding  user 
base  and  its  growing  importance  to  the  functioning  and  security  of  the  nation.  William  Lowrance 
in  his  book,  Of  Acceptable  Risk,  warns  that  risk  acceptance  may  simply  be  a  passive  continuance 
of  “historical  momentum”  which  persists  because  no  alternatives  are  seen  or  the  level  of  risk  may 
not  be  fully  understood  or  appreciated. 98  As  the  penetration  of  GPS  into  the  military  and  civil 
infrastructure  continues  unabated,  it  is  imperative  the  effects  of  a  GPS  disruption  on  the  military 
and  civil  infrastructure  and  the  national  economy  be  fully  appreciated.  When  considering  satellite 
replenishment  policy,  one  must  account  for  all  relevant  costs  and  risks  involved,  not  simply  those 
direct  costs  associated  with  purchasing  and  launching  a  new  satellite.  Additional  costs  include 
the  potential  catastrophic  consequences  resulting  from  a  loss  or  degradation  in  GPS  service  as 
well  as  the  enhanced  capabilities  that  have  been  foregone  in  favor  of  delaying  launches. 

While  it  is  beyond  the  scope  of  this  paper  to  quantify  the  risks  and  the  associated  costs  of 
a  GPS  degradation,  this  chapter  will  attempt  to  illuminate  some  of  the  possible  consequences  and 
vulnerabilities  involved  with  the  aging  GPS  constellation. 

The  Limits  Of  Graceful  Degradation 

Despite  the  fragile  condition  of  the  constellation,  there  is  little  chance  for  a  failure  of  the 
entire  system.  According  to  Owen  Wormser,  the  Assistant  Secretary  of  Defense  responsible  for 
overseeing  space  communications  issues,  GPS  can  withstand  the  loss  of  several  satellites  before 
completely  collapsing.  “If  it  ever  came  to  it,  the  system  would  degrade  slightly,  rather  than  seize 
up,”  he  says.99  The  ability  of  a  system  to  fail  gradually,  as  opposed  to  catastrophically,  is  the 
concept  of  graceful  degradation. 


William  W.  Lowrance,  Of  Acceptable  Risk  (Los  Altos,  CA:  William  Kaufmann,  Inc.,  1976), 
Zolli,  40 
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Graceful  degradation  is  fundamental  to  the  design  of  the  GPS  constellation.  The 
placement  of  satellites  within  each  orbital  plane  is  designed  to  improve  the  constellation’s  overall 
robustness.  Robustness  is  the  ability  of  a  satellite  constellation  to  provide  continued  coverage 
and  service  availability  during  satellite  failures. 100  Coverage  is  defined  as  the  terrestrial  service 
volume  and  the  space  service  volume  in  which  GPS  service  is  provided.  Service  availability  is 
the  percentage  of  time  the  required  GPS  position  accuracy  is  provided  within  a  defined  coverage 
volume. 101  The  twenty-four  satellites  in  the  baseline  constellation  are  positioned  so  a  single 
satellite  failure  will  not  significantly  degrade  global  availability  or  reduce  global  coverage. 102 

However,  graceful  degradation  does  not  preclude  localized  service  from  being  effected 
by  one  or  two  satellite  anomalies.  For  the  baseline  twenty-four  satellite  constellation,  there  are 
some  locations  that  can  experience  up  to  thirty -nine  minutes  of  time  when  positioning  service  is 
lost  entirely  for  the  worst-case  two-satellite  out  combination. 103  In  this  twenty-two  satellite 
constellation,  thirteen  percent  of  the  world  would  experience  a  daily  loss  of  GPS  service  with  the 
average  loss  of  service  reaching  seven  minutes  in  duration. 104  While  seven  minutes  may  not  seem 
severe,  the  loss  of  GPS  service  during  the  final  moments  of  an  aircraft  landing  under  low 
visibility  conditions  could  be  catastrophic.  So  while  its  true  the  constellation  will  not  collapse 
entirely  from  one  or  two  satellite  failures,  one  should  take  little  comfort  in  this  fact.  Users  are 
still  susceptible  to  potentially  catastrophic  effects  due  to  multiple  satellite  failures  even  while 
global  performance  metrics  continue  to  far  exceed  requirements.  In  summary,  graceful 
degradation  is  a  concept  that  only  ensures  continued  performance  at  the  constellation  and  global 
level,  but  it  is  not  intended  to  protect  navigation  and  timing  users  in  limited  geographical  areas. 

100  N.W.  Rhodus  and  P.D.  Massatt,  "GPS  Baseline  Constellation  Update,"  (1991),  18. 

101  Air  Force  Space  Command  and  Air  Combat  Command,  Operational  Requirements  Document 
(ORD)  AFSPC/ACC  003-92-1/11/111  Global  Positioning  System  (GPS),  1 8  February  2000,  33. 

102  SS-GPS-300E,  12. 

103  Assistant  Secretary  of  Defense  for  Command,  Control,  Communications,  Intelligence,  A- 16. 

104  Ibid. 
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Appendix  B  contains  two  case  studies  of  past  satellite  anomalies.  Both  anomalies 


impacted  large  geographical  areas  and  clearly  depict  the  inadequacy  of  graceful  degradation  in 
preventing  potentially  catastrophic  results  to  users.  In  both  cases,  the  anomalies  had  unexpected 
consequences  on  military,  civil,  and  commercial  applications,  including  safety-of-life  aviation 
and  maritime  transportation  augmentation  systems.  The  growing  pervasiveness  of  GPS  has 
exposed  numerous  civil  and  military  systems  to  new  vulnerabilities. 

Growing  Civil  Vulnerabilities 

Over  the  past  fifteen  years  GPS  has  become  fully  integrated  into  the  Global  Information 
Infrastructure. 105  The  growth  of  the  Global  Information  Infrastructure,  to  include  GPS,  has 
played  a  key  role  in  dramatically  changing  how  the  nation’s  infrastructure  and  military  operate. 
In  the  recent  past,  the  many  components  of  the  nation’s  infrastructure  operated  independently  of 
one  another.  The  stand-alone  nature  of  the  various  sectors  and  systems  of  the  infrastructure  were 
inefficient,  but  a  failure  in  one  system  remained  isolated  to  that  system.  Today,  diverse  sectors 
ranging  from  banking  and  finance  to  wastewater  treatment  and  emergency  services  have  become 
inextricably  linked  through  the  power,  telecommunications,  and  information  systems 
infrastructures.  The  networking  and  automation  of  assets  have  improved  efficiencies,  lowered 
costs,  and  expanded  available  capacity. 106  This  has,  in  turn,  increased  competition  among 
utilities,  motivated  them  to  reduce  costs,  and  placed  greater  demands  on  an  already  strained 
infrastructure  weakened  by  years  of  neglect. 107  These  pressures  have  further  fueled  the  trend  to 
seek  additional  efficiencies  in  automation  and  networking. 


105  The  White  House,  (accessed). 

106  Miriam  Heller,  "Interdependencies  in  Civil  Infrastructure  Systems,"  The  Bridge,  [Internet] 
(Winter  2001,  accessed  4  December  2003);  available  from 
http://www.nae.edu/nae/naehome.nsf/weblinks/KGRG-573PLA70penDocument. 

107  Ibid,  (accessed). 
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These  improvements  and  efficiencies  have  not  been  achieved  without  a  sizable  cost.  The 
networking  of  infrastructures  and  the  sharing  of  information  across  systems  creates  dependencies 
and  vulnerabilities  that  never  before  existed.  Because  of  the  widespread  use  of  information 
technology,  a  disturbance  within  one  system  of  a  sector,  such  as  a  GPS  satellite  outage,  may  be 
transferred  to  another  system  in  an  entirely  different  sector.  The  new  system  of  large-scale, 
complex  systems  has  created  an  emerging  meta- infrastructure  system. 108  A  system  failure  within 
the  meta- infrastructure  can  create  complex,  vertical  interactions  within  and  between  systems  as 
well  as  horizontal  interplay  between  sectors.  However,  the  distributed  nature  of  most 
infrastructures,  the  enormous  number  of  elements  involved,  and  their  complex  interdependencies 
prevents  one  from  knowing  a  priori  the  vulnerabilities  of  a  system  and  how  a  disturbance  will 
propagate  through  an  infrastructure  and  possibly  effect  other  related  infrastructures. 109 

While  there  have  been  numerous  studies  related  to  civil  GPS  use,  no  consistent  or 
objective  method  for  assessing  its  cost,  benefits,  and  risks  have  been  established.1 10  Part  of  the 
problem  involves  the  multifarious  nature  of  GPS  applications  and  the  interdependent,  complex 
character  of  meta- infrastructures.  The  tighter  interdependencies  between  systems  and  sectors  and 
their  increasing  automation  has  raised  new  problems  with  analyzing  a  system's  risks  and 
vulnerabilities.  Accordingly,  there  is  currently  no  single,  best  method  for  scientifically  assessing 
the  potential  consequences  of  meta -infrastructure  disruptions. 111  Dr.  Brown  of  Sandia  National 
Laboratory’s  Infrastructure  Interdependencies  Program  succinctly  explains  the  difficulty  of 
evaluating  the  risks  to  the  nation’s  infrastructure.  She  writes: 

Direct  dependencies  are  generally  easy  to  recognize,  describe  and  evaluate  and  past 

responses  to  outages  may  provide  an  indication  of  potential  consequences  of  outages. 

108  Ibid,  (accessed). 

109  Brown,  1. 

1 111  Brian  B.  Mahoney  and  Yacov  Y.  Hairnes,  "Quantitative  Risk  Analysis  of  GPS  as  a  Critical 
Infrastructure  for  Civilian  Transportation  Applications,"  ION  GPS  2001, 1 1-14  September  2001,  Salt  Lake 
City,  UT,  58. 

1 1 1  Heller,  (accessed). 
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However,  as  the  interdependencies  increase  the  complexity  and  alter  system  responses, 
the  secondary  effects  and  feedback  mechanisms  may  generate  unforeseen  consequences 
or  reduce  the  magnitude  of  what  appear  to  be  considerable  risks.  Events  that  caused 
isolated  faults  in  the  past  could  now  result  in  widespread  disruptions.  Additionally,  and 
perhaps  even  more  significantly,  disruptions  considered  minor  or  acceptable  at  the  scale 
of  an  infrastructure  may  now  cause  significant  outages  in  a  single  operation  or  process 
critical  to  another  infrastructure.112 

In  short,  the  very  characteristics  that  make  meta- infrastructures  difficult  to  analyze  are 
the  same  ones  that  can  also  cause  a  seemingly  trivial  component  failure  to  quickly  spread 
throughout  the  system.  An  incident  that  might  seem  inconsequential  can  ultimately  have 
catastrophic  effects. 113  Meta-infrastructures  that  are  complex  and  highly  interdependent  are  more 
vulnerable  to  “unavoidable  system  accidents.”114 

In  recognition  of  the  new  vulnerabilities  of  the  nation’s  infrastructure  to  disruption, 
President  Clinton  issued  an  infrastructure  protection  directive  known  as  PDD-63.  This  policy 
identifies  twelve  infrastructures  as  “essential  to  the  minimum  operations  of  the  economy  and 
government”  and  deemed  them  as  “critical  infrastructure.”113  These  systems  have  been  singled 
out  because  of  their  central  role  in  the  welfare,  security,  and  survival  of  the  nation.  They  include, 
but  are  not  limited  to,  information  and  communications,  banking  and  finance,  water  supply, 
transportation,  emergency  law  enforcement,  emergency  fire  service,  electric  power,  oil  and  gas 
production  and  storage,  foreign  intelligence,  and  national  defense.116  The  twelve  critical 
infrastructures  and  their  relationships  to  GPS  are  listed  in  Table  1.  The  directive  specifies,  “Any 
interruptions  or  manipulations  of  these  critical  functions  must  be  brief,  infrequent,  manageable, 


1 1  Brown,  2. 


113  Charles  Parrow,  Normal  Failures:  Living  with  High  Risk  Technologies  (Princeton  NJ: 
Princeton  University  Press,  1999),  92. 

114  Ibid.,  72. 

115  "White  Paper  on  the  Clinton  Administration's  Policy  on  Critical  Infrastructure  Protection: 
Presidential  Decision  Directive  63,"  [Internet]  (22  May  1998,  accessed  3  February  2004);  available  from 
http://www.fas.org?irp/offdocs/paper598.htm. 

116  Ibid,  (accessed). 
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geographically  isolated  and  minimally  detrimental  to  the  welfare  of  the  United  States.”117 
Although  this  policy  is  chiefly  aimed  at  the  need  to  defend  against  physical  and  cyber  attacks,  it 
nonetheless  clearly  articulates  the  importance  of  protecting  these  systems  from  disruption  and 
stresses  their  inherent  vulnerability  to  cascading  effects.  Whether  these  cascading  effects  are 
initiated  via  attack  on  the  GPS  constellation  or  by  satellite  malfunction  is  largely  irrelevant  if  the 
resulting  disruption  is  identical. 

Conspicuously  absent  from  the  twelve  critical  infrastructures  is  GPS  itself.  In  the  wake 
of  the  terrorist  attacks  on  the  World  Trade  Center  and  the  Pentagon,  the  Heritage  Foundation 
Homeland  Security  Task  Force  was  established  to  recommend  priorities  for  preventing  future 
attacks  and  to  limit  their  effects  should  one  occur.  In  their  report,  “Defending  the  American 
Homeland,”  the  Task  Force  sought  to  correct  this  oversight.  The  report’s  number  two  priority  for 
protecting  the  nation’s  infrastructure  is  to  designate  the  GPS  constellation  as  a  critical  national 
infrastructure  because  of  the  vital  role  it  plays  in  national  security  and  as  an  enabler  for  the  other 
critical  infrastructures. 118  This  recommendation  clearly  emphasizes  the  central  importance  of  a 
functioning  GPS  constellation  to  homeland  security,  national  defense,  and  the  economy  and 
places  it  on  equal  footing  with  the  other  critical  systems. 

Despite  the  clarity  with  which  many  doomsday  scenarios  seem  to  foretell,  our  true 
understanding  of  the  consequences  of  a  loss  or  degradation  of  GPS  service  on  civil  and  military 
applications  is  limited  and  shrouded  in  uncertainty  and  ignorance.  Without  a  clear  understanding 
of  the  risks  and  vulnerabilities  the  aging  GPS  constellation  poses  to  the  nation’s  infrastructures 
and  military  operations,  it  is  impossible  to  optimize  the  costs  and  benefits  of  the  satellite 
replenishment  strategy.  In  such  a  scenario,  it  is  likely  for  risk  acceptance  (and  satellite 


117  Ibid,  (accessed). 

1 18  Bremer  and  Meese,  2. 


35 


replenishment  strategy)  to  reflect  “historical  momentum”  and  not  be  based  on  what  the  situation 


truly  warrants. 


Critical  Infrastructure 

GPS  Dependencies 

Information  and 
Communications 

GPS  central  to  network  synchronization,  encryption, 
positioning  and  time  transfer 

Banking  and  Finance 

GPS  timing  used  for  encryption,  legal  time  traceability, 
and  internet  timing 

Water  Supply 

No  apparent  direct  involvement 

Transportation 

GPS  used  in  virtually  every  mode  of  transportation; 
many  include  safety  of  life 

Emergency  Services 

GPS  critical  to  location  of  downed  aircraft,  car 
accidents,  and  maritime  rescue.  Also  used  in  the 
dispatch  and  control  of  public  safety  vehicles. 

Public  Health  Services 

GPS  timing  for  telemedicine 

Electric  Power 

GPS  timing  synchronizes  electric  power  grid;  detects 
and  precisely  locates  grid  faults 

Oil  and  Gas  Production  and 
Storage 

GPS  critical  for  monitoring  large  oil  tankers  in  narrow 
waterways 

Internal  Defense119 

GPS  timing  and  positioning  for  Enhanced  911,  precise 
incident  location  and  reporting,  emergency  dispatch, 
encrypted  communications,  tracking  of  aircraft  and 
ships 

Foreign  Intelligence 120 

GPS  positioning  and  timing  used  in  spacecraft  attitude 
control  systems,  geolocation,  and  mission  planning. 

National  Defense 

GPS  timing  and  positioning  central  to  network  centric 
warfare 

Table  1.  GPS  Dependencies121 


The  following  sections  will  examine  GPS’  contribution  to  four  critical  infrastructures. 
These  four  have  been  selected  based  on  their  criticality.  Of  the  twelve  critical  infrastructures 
identified  in  PDD-63,  Willis  Ware  argues  that  the  power,  telecommunications  and  information 


119  Dr.  L.  Jocic  and  others,  "Space  Overlay  for  Homeland  Security  Communications  and 
Navigation,"  National  Technical  Meeting,  22-24  January  2003,  Anaheim,  CA,  741-744. 

12,1  Patrick  W.  Binning,  Alan  S.  Hope,  and  Mark  T.  Soyka,  "Orbit  Determination  and  Prediction 
Concept  for  NEMO,  the  Naval  Earthmap  Observer  Program,"  ION  GPS  1999,  14-17  September  1999, 
Nashville,  TN,  837.  The  Naval  EarthMap  Observer  (NEMO),  an  unclassified  remote  sensing,  hyperspectral 
imaging  spacecraft  prototype,  uses  GPS  for  accurate  image  geolocation  and  autonomous  image  planning 
and  execution. 

121  Parkinson,  8.;  and  "White  Paper  on  the  Clinton  Administration's  Policy  on  Critical 
Infrastructure  Protection:  Presidential  Decision  Directive  63,  (accessed). 
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systems  are  the  most  critical  systems  in  the  nation’s  infrastructure. 122  There  is  nearly  universal 
dependence  on  telecommunications  to  operate  all  other  infrastructure  components.  Information 
systems,  linked  together  by  telecommunications  systems,  must  also  function  for  most  other 
aspects  of  the  infrastructure  to  operate.  Energy  is  necessary  for  facilities  and  equipment  used  by 
telecommunications  and  information  systems.  Consequently,  these  three  systems  are  the  most 
critical  and  are  tightly  coupled  with  one  another.123  In  addition  to  these  three  systems,  the  chapter 
will  also  address  the  transportation  sector  because  its  “present  or  potential  vulnerability  to 
degradation  or  loss  of  GPS  will  have  catastrophic  consequences  to  either  human  life  or  economic 
and  environmental  damage.”124 

The  author  readily  admits  that  by  studying  these  infrastructures  in  isolation,  one  risks  the 
chance  of  missing  important  cross-sector  and  multi-sector  vulnerabilities.  Lost  in  this  review  are 
the  millions  of  dollars  in  indirect  costs  arising  from  a  GPS  satellite  failure  due  to  lost  credit  card 
sales,  missed  market  trades,  failed  bank  machines,  delayed  overnight  deliveries,  tardy  just-in-time 
manufacturing,  and  the  inability  to  contact  emergency  medical  services.  As  Dorner  warns,  “To 
deal  with  a  system  as  if  it  were  a  bundle  of  unrelated  individual  systems  is,  on  the  one  hand,  the 
method  that  saves  the  most  cognitive  energy.  On  the  other  hand,  it  is  the  method  that  guarantees 
neglect  of  side  effects  and  repercussions  and  therefore  guarantees  failure.  If  we  have  no  idea  how 
the  variables  of  the  system  influence  one  another,  we  cannot  take  these  influences  into 
account.”125  Regardless,  this  limited  review  of  the  role  of  GPS  and  its  contributions  to  the  nation 
hints  at  the  possible  expense  and  cascading  consequences  that  can  result  from  a  regional 
degradation  of  GPS. 


1  22  Willis  H.  Ware,  The  Cyber-Posture  of  the  National  Information  Infrastructure  (Santa  Monica, 
CA:  RAND,  1998),  17. 
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124  John  A.  Volpe  Center,  5. 
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Transportation 


The  best-known  civil  use  of  GPS  is  in  aviation,  maritime,  and  surface  transportation 
navigation.  The  transportation  industry  has  rapidly  embraced  GPS  technology  because  of  its 
worldwide  coverage,  improved  accuracy,  and  rapidly  decreasing  user  equipment  costs.126  The 
widespread  adoption  of  GPS  promises  to  improve  safety,  increase  operational  effectiveness,  and 
lower  transportation  costs.  However,  as  GPS  becomes  more  fully  integrated  into  the 
transportation  sector,  legacy  systems  such  as  ground  based  surveillance  radar  will  be  eliminated 
and  the  dependence  on  GPS  will  continue  to  grow.  Consequently,  the  loss  of  the  GPS  signal  to 
the  transportation  sector  could  be  severe.127 

The  aviation  industry  has  set  the  groundwork  for  the  use  of  GPS  in  nearly  every  phase  of 
flight.  The  FAA  has  certified  GPS  as  a  primary  means  for  navigation  during  oceanic  operations 
and  as  a  supplemental  navigation  system  for  domestic  enroute,  terminal,  and  non-precision 
approach  phases  of  flight. 128  GPS  and  its  augmentations  are  being  further  integrated  into  the 
aviation  infrastructure  to  support  aviation  modernization  programs  to  reduce  aircraft  separation 
distances  for  en  route  operations  and  to  provide  more  efficient  routing  of  commercial  air  traffic. 
These  improvements  promise  to  reduce  flight  times,  save  fuel,  and  cut  costs.  The  continuing 
acceptance  of  GPS  will  reduce  the  number  of  costly  ground  navigation  aids  and  the  suite  of 
cockpit  avionics  needed,  thus  further  increasing  the  transportation  industry’s  dependence  on  GPS. 

The  growing  reliance  on  GPS  has  some  concerned  about  the  ability  of  the  aviation 
industry  to  safely  operate  in  case  of  a  GPS  failure.  Langhorne  Bond,  former  administrator  of  the 
Federal  Aviation  Administration  (FAA),  has  stated,  “GPS  positioning  and/or  timing  [has]  crept 
into  all  three  elements  of  the  NAS  [National  Airspace  System]— communications,  navigation,  and 

126  John  A.  Volpe  Center.  1. 

127  Ibid.,  43-48. 
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surveillance.  Now  we  have  a  common  failure  mode  that  could  bring  down  the  entire  ATC  [air 
traffic  control]  system.”129  A  severe  outage  of  GPS  would  effect  aviation  safety  if  extensive 
vectoring  of  aircraft  around  the  outage  were  necessary.  The  grounding  of  aircraft  until  the 
disturbance  subsided  would  cause  an  “enormous”  economic  impact. 130 

The  Department  of  Transportation  (DOT)  has  investigated  the  potential  impact  of  a  short 
or  long  term  GPS  outage  on  the  national  transportation  infrastructure.  The  DOT  study,  titled 
“Vulnerability  Assessment  of  the  Transportation  Infrastructure  Relying  on  the  Global  Positioning 
System,”  found  the  “civil  transportation  infrastructure  ...  is  developing  a  reliance  on  GPS  that 
can  lead  to  serious  consequences  if  the  service  is  disrupted,  and  the  applications  are  not  prepared 
with  mitigating  equipment  and  operational  procedures.”131  The  study  further  concluded  a  loss  of 
GPS  service  could  disrupt  transportation  service  resulting  in  economic  damage,  property  damage, 
serious  injury  or  fatality,  loss  of  confidence  in  a  transportation  mode,  and  liability  to  the  service 
provider. 132 

Maritime  operations  are  similarly  becoming  more  dependent  on  GPS  for  both  navigation 
and  communication.  The  International  Maritime  Organization  (IMO)  has  mandated  that  the 
estimated  20,000  ships  internationally  registered  in  1999  be  equipped  with  a  GPS-based  tracking 
system  by  2007. 133  The  system  transmits  automated  tracking  reports  containing  ship 
identification,  position,  heading,  and  velocity  from  ship-to-ship  and  ship-to-shore.  In  addition  to 
the  improved  situational  awareness  it  provides,  the  pinpoint  accuracy  GPS  delivers  in  all  weather 
conditions  enhances  the  efficiency  of  shipping  within  restricted  and  heavily  congested  waterways 

129  Charlotte  Adams,  "GPS:  How  Vulnerable  Is  GPS?,"  Avionics  Magazine,  [Internet]  (2001, 
accessed  16  January  2004);  available  from  http://www.defensedaily.com/reports/vulnerable_gps.htm. 

130  John  A.  Volpe  Center,  41,  43-44.  A  severe  outage  is  one  that  lasts  days  over  wide  areas  or  a 
series  of  moderate  length  outages  over  a  wide  area. 
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such  as  harbors  and  channels  and  reduces  the  risk  of  collision  and  oil  tanker  spillage.  The  loss  of 


GPS  by  itself  would  probably  be  manageable,  but  when  combined  with  poor  weather  or  a 
mechanical  failure,  the  consequences  could  be  serious.  An  off-course  vessel  in  a  constricted 
waterway  is  often  only  seconds  away  from  grounding  or  colliding  with  another  nearby  ship.  The 
loss  of  GPS  navigation  could  leave  a  ship’s  captain  blind  and  only  seconds  from  trouble.  The 
environmental  and  economic  loss  from  such  an  accident  would  be  significant. 134 

Telecommunications  and  Information  Systems 

Not  only  is  GPS  positioning  data  a  tremendous  asset  to  transportation  systems,  its  timing 
signal  is  becoming  deeply  imbedded  into  the  global  information  infrastructure  used  for  both 
wireless  and  fiber  voice,  data,  and  video  networks.  Precise  timing  has  become  an  enabler  for  the 
proliferation  of  geographically  distributed  computing.  A  U.S.  Space  Command  report  has  even 
stated  that  the  timing  signal  is  now  more  commercially  important  than  the  positioning  services  it 
provides. 135  The  value  of  GPS  timing  to  the  national  telecommunication  and  information  systems 
and  its  contributions  to  the  nation’s  economic  strength  and  military  prowess  is  immeasurable. 

Solitary  computers  working  in  isolation  have  been  replaced  by  distributed  servers  and 
workstations  connected  to  local  area  networks.  Local  area  networks  have,  in  turn,  been 
connected  to  larger,  global  networks.  The  emerging  system  of  networks  require  stable  clocks 
accurate  to  the  millisecond  to  synchronize  shared  databases,  time  stamp  transactions,  and 
coordinate  distributed  applications. 136  However,  most  workstations  operate  with  inexpensive, 
internal  crystal  oscillators  for  their  timing  source  which  can  lose  up  to  10  seconds  per  day. 137  In 


134  John  A.  Volpe  Center,  45. 

135  Dailey,  303. 

136  Paul  Skoog,  "The  Importance  of  Network  Time  Synchronization"  [Internet]  (n.d.,  accessed  16 
January  2004);  available  from  http://www.truetime.net/pdf/imp_netsync.pdf. 

137  Richard  E.  Schmidt,  "GPS  Times  the  Internet,"  GPS  World,  February  2000,  44. 
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order  for  thousands  of  computers  to  efficiently  and  reliably  exchange  information  across 


thousands  of  miles,  it  is  crucial  their  timing  be  in  unison. 

Not  long  ago,  network  timing  originated  from  a  limited  number  of  hyper- accurate 
external  timing  sources.  The  timing  signals  from  these  sources  were  passed  along  sequentially 
throughout  the  system  and  were  used  to  discipline  the  less  accurate  crystal  oscillators. 138  The 
most  common  external  timing  sources  were  highly  stable  but  expensive  cesium  atomic  clocks. 
These  clocks  cost  as  much  as  $55,000  a  piece  and  were  difficult  to  operate  and  maintain. 139  The 
superior  performance  of  GPS  as  a  timing  source  and  the  ability  to  economically  install 
inexpensive  GPS  receivers  throughout  a  network  has  revolutionized  the  way  synchronization  is 
accomplished  today.  GPS  has  become  the  most  widely  used  timing  source  for  distributing 
dependable  and  accurate  timing  signals  to  the  Internet  as  well  as  to  smaller  local  area  networks. 140 

Several  additional  trends  have  led  to  the  widespread  adoption  of  GPS  as  the  timing 
standard  of  choice.  First,  the  ever  growing  demand  for  greater  throughput  capacity,  speed,  and 
cost  efficiency  has  driven  the  telecommunication  industry  to  incorporate  digital  lines  and  servers 
into  their  communication  architecture.  Digital  communications,  however,  are  more  complex  and 
are  more  susceptible  to  timing  errors  than  their  analog  counterparts. 141  In  a  digital  network, 
information  is  broken  down  into  tiny,  discrete  packets.  Each  of  these  packets  is  encoded  with  a 
time  stamp  before  being  transmitted  across  the  network.  After  the  data  packets  reach  their 
destination,  computers  must  reassemble  them  according  to  their  time  stamps.  Failure  to  keep  the 
source  and  receiver  clocks  in  lock  step  will  cause  information  to  be  dropped,  misread,  or 


138  Jeremy  Kintzel,  "Timing  Is  Everything,"  Wireless  Review,  [Internet]  (1  September  2001, 
accessed  3  May  2004);  available  from  http://www.wirelessreview.com/microsites/magazinearticle.asp. 

139  Chris  Bucholtz,  "Timing  from  a  Higher  Source  GPS  Could  Help  Put  All  Networks  in  Sync," 
Telephony  Online ,  [Internet]  (17  June  1996,  accessed  29  October  2003);  available  from 
http://telephonyonline.com/ar/telecom_timing_higher_source/index.htm.;  and  Ed  Butterline  and  Sally  L. 
Frodge,  "GPS:  Synchronizing  Our  Telecommunications  Networks,"  ION  GPS  1999, 14-17  September 
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repeated.  Synchronization  is  the  means  of  keeping  these  elements  operating  at  the  same  rate  and 
is  essential  for  reliable  operation. 142  As  GPS  timing  continues  to  improve,  synchronization  can  be 
made  more  precise  by  reducing  the  spacing  between  digital  data  packets.  As  a  result,  more  data 
can  be  “squeezed”  into  the  same  space,  thereby  improving  the  efficiency  and  speed  of  digital 
applications  and  maximizing  the  utilization  of  the  available  bandwidth. 143 

The  proliferation  of  long  distance  carriers  and  cell  phones  have  also  increased  the  need 
for  synchronization.  One  long  distance  phone  call  may  transit  a  network  by  using  several 
different  carriers  before  it  reaches  its  final  destination.  Each  carrier  must  synchronize  its  network 
to  the  networks  of  other  carriers  to  whom  it  is  connected  to  ensure  a  clean  and  efficient  handover 
of  data.  In  a  similar  fashion,  as  a  cell  phone  user  transits  through  her  cell,  the  wireless  network 
must  know  where  the  caller  is  located  with  respect  to  its  towers  and  cleanly  handover  the  caller 
from  one  tower  to  the  next.  These  multiple  interfaces  must  be  properly  managed  to  achieve  a 
seamless  communication  infrastructure.  If  carriers  or  towers  use  timing  sources  that  are  not 
consistent  with  one  another,  there  may  be  timing  mismatches.  Depending  on  the  severity  of  a 
timing  mismatch,  it  may  be  merely  a  nuisance  or  a  drag  on  the  efficient  use  of  bandwidth.  In 
more  severe  cases,  the  mismatch  can  cause  a  fault  to  promulgate  throughout  the  network,  causing 
ever  greater  problems  as  it  progresses.  In  the  extreme  case,  a  geographic  telecommunications 
blackout  can  occur. 144 

The  impact  of  even  a  trivial  timing  error  on  communications  networks  is  hard  to  predict. 
Take  for  instance  a  brief  GPS  satellite  anomaly  that  occurred  in  1997.  During  routine  navigation 
payload  commanding  by  satellite  operators,  erroneous  timing  data  was  uploaded  to  a  single 
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satellite.  The  satellite  broadcast  a  thirty-second  timing  error  for  a  mere  six-second  period  before 
it  automatically  removed  itself  from  service.  This  was,  however,  long  enough  for  numerous 
timing  users  in  the  eastern  United  States  to  take  an  erroneous  time  hack  from  the  satellite. 

Cellular  telephone  networks  were  especially  hit  hard.  Out  of  800  cellular  sites  in  that  region  of 
the  country,  1 10  sites  failed.  Thousands  of  cell  phone  customers  were  left  without  service  for 
several  hours,  causing  millions  of  dollars  in  damage.145 

A  loss  or  degradation  of  GPS  timing  can  be  visible  to  customers  in  a  number  of  ways 
depending  on  the  application.  As  already  mentioned,  a  complete  loss  of  GPS  timing  can  bring 
down  an  entire  digital  network. 146  Fortunately,  there  is  redundant  timing  and  failsafe  measures 
built  into  many  systems  to  prevent  a  widespread  blackout.  Less  sensitive  analog  applications  can 
continue  to  “coast”  along  using  their  less  accurate,  internal  clocks  for  a  week  to  one  month.147 
However,  without  an  accurate  external  clock  reference,  the  timing  of  the  various  elements  of  the 
system  will  slowly  drift  until  call  control  can  no  longer  function. 148  Less  serious  timing  faults  can 
manifest  themselves  in  a  number  of  ways,  depending  on  the  application.  Temporary  timing  errors 
in  an  analog  voice  signal  will  result  in  cross-talk  or  static,  faxes  will  lose  portions  of  their  image, 
and  video  teleconferencing  and  telemedicine  will  experience  frozen  frames.  A  mistimed  digital 
signal  can  cause  jitter,  a  phenomena  where  the  signal  is  briefly  but  completely  cut  out.  More 
severe  timing  anomalies  can  cause  blocks,  lost  handoffs  between  cell  phone  towers,  or  failed  call 
setups. 144  In  addition,  many  encryption  schemes  are  very  sensitive  to  timing  errors  and  will  cause 
a  secure  connection  to  fail.  The  attempts  to  re-establish  the  secure  connection  will  further  reduce 
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data  rates  and  will  expose  the  encryption  keys  to  compromise. 150  Pagers,  ATMs,  e-commerce, 
banking,  market  trading,  and  the  Internet  could  all  be  disrupted.  All  of  these  failures  can  range 
from  mere  annoyances  and  inconvenience  to  inefficiencies,  fiscal  losses,  or  loss  of  life. 

Power  Generation  and  Distribution 

GPS  is  also  ideal  for  economically  distributing  a  precise,  common  time  reference 
throughout  the  large  geographical  areas  that  electrical  power  systems  occupy.  Precise  timing  is 
essential  for  electrical  power  generation  control,  system  monitoring,  analysis,  and  fault  detection 
and  location.  GPS  is  replacing  older  timing  sources  in  many  areas  because  it  offers  improved 
accuracy,  reliability,  and  economy.151 

The  nation’s  electrical  power  infrastructure  consists  of  four  massive  power  grids  which 
span  most  of  the  continent.  Each  grid  is  subdivided  into  several  utility  service  areas  which 
contain  numerous  power  generators.  The  utility  service  areas  and  power  grids  are  interconnected 
to  permit  efficient  and  economical  power  sharing  and  load  leveling. 152  The  electric  power  grid  is 
a  very  dynamic  system  requiring  constant  balancing  of  power  generation  with  shifting  loads. 
Since  electricity  cannot  be  stored  for  later  use,  power  generation  must  exactly  match  the  rate  it  is 
used.  This  requires  constant  real-time  monitoring  and  sophisticated  controls  to  dynamically 
restore  system  stability  by  adjusting  generator  output  and  shedding  of  loads. 153  The  output  from 
each  generator  must  also  be  care  fully  controlled  to  ensure  it  meets  stringent  standards  to  permit 
the  seamless  transfer  and  sharing  of  power  across  utility  boundaries.  For  instance,  the  alternating 
current  (AC)  power  generated  in  Tennessee  must  be  consistent  with  the  AC  power  in  Arizona  in 
terms  of  frequency,  phase  angle,  and  voltage  magnitude.  GPS  provides  a  common,  accurate 
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timing  reference  that  can  be  used  by  all  utilities  across  North  America  to  synchronize  their  power 

•  1 54 

generation. 

GPS  timing  is  also  used  by  automated  monitoring  and  recording  equipment  to  detect 
local  and  system-wide  disturbances.  A  generator  failure  or  a  transmission  line  outage  can  cause  a 
damaging  disturbance  to  ripple  throughout  the  system.  These  failures  must  be  quickly  detected 
and  isolated  to  protect  interconnected  generators  and  to  prevent  the  needless  isolation  of  a  utility 
service  area  from  the  remainder  of  the  grid.  Fault  location  equipment  located  at  substations  and 
transmission  line  towers  can  pinpoint  a  failure  to  within  three  hundred  meters  by  triangulating  the 
differences  in  the  time  of  arrival  of  the  disturbance  as  it  propagates  throughout  the  system. 155 
Rapid  fault  location  can  significantly  reduce  the  time  needed  to  restore  electrical  service. 

For  many  of  these  applications,  only  GPS  can  deliver  the  required  timing  accuracy  at  a 
cost  that  permits  it  to  be  widely  used  throughout  the  system.  Consequently,  GPS  is  becoming 
more  tightly  integrated  within  the  nation’s  power  infrastructure.  A  reliable  GPS  signal  is 
essential  for  the  power  system's  safe  and  reliable  operation.156 

Military  Vulnerabilities 

Just  as  civil  infrastructure  has  become  more  reliant  on  the  GPS  signal,  so,  too,  has  the 
U.S.  military.  Since  the  Gulf  War,  joint  military  operations  have  become  increasingly  dependent 
on  information  superiority  and  the  ability  to  collect,  process,  and  distribute  relevant  information 
through  a  network  of  widely  dispersed  sensors  and  shooters. 157  The  primary  mechanism  to 
achieve  the  vision  of  information  superiority  is  through  the  concept  of  network  centric  warfare 
(NCW).  GPS  is  a  fundamental  element  to  achieving  the  technological  vision  of  NCW.  For  its 
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proponents,  NCW  represents  an  “emerging  theory  of  war”  which  recognizes  that  combat  power  is 
no  longer  derived  from  die  Industrial  Age  concept  of  mass.  Rather,  combat  power  in  the 
Information  Age  is  generated  from  the  timely  access  to  quality  information  which  leads  to 
improved  battlespace  awareness. 158  Heightened  battlespace  awareness  enables  dispersed  forces  to 
self -synchronize  themselves  to  the  commander’s  intent  thereby  achieving  greater  speed  of 
command,  increased  operations  tempo,  enhanced  lethality,  and  improved  survivability. 159  In 
theory,  networked  forces  have  access  not  only  to  their  own  resident  capabilities  but  also  to  the 
capabilities  distributed  across  the  entire  network.  A  commander  can  use  the  power  of  the 
network  to  reach  across  the  theater  to  select  the  most  appropriate  munition  based  on  the  target, 
the  risk  of  collateral  damage,  the  required  responsiveness,  and  the  desired  probability  of  damage. 
Networking  ultimately  has  the  potential  to  exponentially  increase  the  combat  power  of  small, 
dispersed  forces  by  improving  their  speed,  precision,  and  reach.  Once  this  is  achieved,  it  is 
believed  a  networked  commander  will  be  able  to  mass  effects  without  massing  forces. 160 

The  military  infrastructure  of  NCW  harnesses  the  power  of  geographically  dispersed 
sensors  and  shooters  by  linking  them  together  into  networks  that  allow  for  the  extremely  rapid, 
high-volume  transmission  of  digitized  data  to  decision  makers.  Technologically,  the  concept  of 
NCW  relies  on  three  tightly  interconnected  grids:  the  sensor,  the  shooter,  and  the  information 
grids. 161  Each  of  these  grids  is  highly  dependent  on  GPS  positioning  and  timing  to  achieve 
discriminate  precision  effects. 
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Information  Grid 


GPS  timing  plays  a  similarly  important  role  in  integrating  the  dispersed  network  of 
diverse  battlefield  sensors  and  munitions  as  it  does  in  synchronizing  distributed  civilian 
infrastructures.  The  information  grid  is  the  backbone  that  lashes  the  sensors,  shooters,  and 
decision  makers  together.  The  information  grid  provides  “the  means  to  receive,  process, 
transport,  store,  and  protect  information  for  the  Joint  and  combined  forces.... This  grid  provides 
the  necessary  infrastructure  to  permit  the  ‘plug  and  play’  of  the  sensors  and  shooters.”162 

Most  fundamentally,  in  order  for  the  sensors,  platforms,  and  systems  spread  across  an 
area  of  operation  to  work  cooperatively,  they  must  be  referenced  to  a  common  time  and  space 
standard.  The  absolute  common  time  scale  used  throughout  the  DoD  is  Universal  Coordinated 
Time  as  maintained  by  the  U.S.  Naval  Observatory  UTC(USNO),  and  the  common  positioning 
reference  has  become  the  World  Geodetic  System  84  (WGS-84).163  GPS  is  the  primary  means 
for  distributing  UTC(USNO)  timing  to  military  users  worldwide,  and  its  positioning  solutions  are 
referenced  to  the  WGS-84  common  grid.  164  Quite  simply,  GPS  is  fundamental  to  the  NCW 
architecture  for  enabling  interoperability  of  all  its  disparate  elements. 

The  complex  NCW  architecture  also  requires  a  high  degree  of  synchronization  across  its 
various  elements  in  order  to  seamlessly  collect  and  exchange  billions  of  bits  of  data  and  fuse  them 
into  a  common  battlefield  picture.  GPS  is  the  primary  means  for  synchronizing  this 
architecture. 165  A  disruption  in  GPS  timing  could  adversely  effect  each  grid  individually  or  it 
could  induce  rippling  regional  effects  across  the  grids.  This  could  leave  the  U.S.  military 
temporarily  blind,  confused,  and  de-fanged.  At  the  very  least,  military  forces  may  worry  about 
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data  quality  and  lose  confidence  in  the  system.  The  fog  and  friction  of  war  would  be  increased, 
and  command  and  control  would  suffer.166  In  a  worst  case  scenario,  a  degraded  GPS  signal  could 
interrupt  the  command  and  control  system  and  isolate  the  Joint  Force  Commander  from  his 
fielded  forces  or  his  reachback  capabilities. 167  It  logically  follows  that  a  combat  force  dependent 
on  an  information- rich  network  must  be  supplied  with  a  robust  and  reliable  information  grid  that 
is  not  susceptible  to  such  failure. 

Sensor  Grid 

The  sensor  grid  consists  of  a  myriad  of  permanent  and  mission-specific  sensors  which 
provide  the  joint  force  with  precise  and  persistent  situational  awareness  over  the  area  of  interest 
to  enable  superior  decision  making.  These  sensors  may  reside  on  a  multitude  of  platforms, 
including  unmanned  aerial  vehicles  (UAVs),  patriot  missile  defense  systems,  attack  helicopters, 
individual  aircraft,  troops  in  ground  vehicles,  special  operations  forces  on  horseback,  and 
intelligence  satellites,  to  name  just  a  few. 

GPS  not  only  helps  to  navigate  the  sensor  platforms  and  to  synchronize  them  with 
maneuver  units  in  time  and  space,  but  its  timing  signal  also  aids  in  accurately  locating  targets 
with  respect  to  the  WGS-84  common  reference  grid.  Sensors  require  an  accurate  reference  time 
to  time  stamp  observations  of  platform  position  or  sensor  measurements  for  geo-referencing. 
Radar  and  laser  sensors,  among  others,  use  precise  timing  to  accurately  range  their  targets  by 
multiplying  the  time  difference  of  arrival  of  an  observation  by  the  speed  of  light. 168  The  more 
precise  the  time  stamp  of  each  measurement,  the  more  accurate  the  range  to  the  target.  Once  the 
data  is  collected,  it  must  again  be  time  tagged  before  being  transmitted  to  the  network  for 
processing  and  for  later  distribution  to  the  rest  of  the  net. 
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For  instance.  Airborne  Warning  and  Control  (AW ACS)  aircraft  can  provide  real-time 
direction  to  attacking  forces  by  referencing  themselves,  their  targets,  and  their  allies  to  within 
meters  by  the  use  of  GPS.169  The  RC-135  Rivet  Joint  aircraft  and  the  U-2R  Dragon  Lady  both 
use  precise  GPS  timing  to  accurately  locate  targets  from  the  signals  and  images  they  collect. 170 
The  Predator  medium  endurance  unmanned  aerial  vehicle  (UAV)  uses  GPS  to  reconnoiter  hostile 
enemy  territory  at  low  altitudes  without  the  fear  of  losing  a  pilot  to  enemy  fire.  With  knowledge 
of  its  own  position  and  the  range  and  angle  offsets  of  its  high  resolution  video  and  still 
photography  sensors,  the  Predator  can  transmit  the  location  of  dynamic  targets  to  another 
platform  for  engagement  and  can  conduct  post-strike  combat  assessments  to  assist  in  re-attack 
recommendations. 171 

Another  GPS-based  sensor  of  significance  is  the  Force  XXI  Battle  Command  Brigade 
and  Below  (FBCB2),  also  known  as  “blue  force  tracker.”  It  allows  soldiers  to  differentiate 
between  enemy  (red)  and  friendly  (blue)  forces.  The  system  uses  GPS  transmitters  mounted  in 
military  vehicles  and  aircraft  to  monitor  their  precise  location.  That  information  is  combined 
with  terrain  maps  and  intelligence  on  enemy  positions  to  create  a  battlefield  picture  that  can  be 
shared  over  commercial  satellite  networks.  The  use  of  blue  force  trackers  during  Iraqi  Freedom 
allowed  commanders  in  the  theater  and  in  the  United  States  to  have  a  “precise  sense  of  the 
location,  capacity  and  capability  of  the  battlefield.” 172  It  also  improved  joint  situational 
awareness  and  was  credited  with  reducing  incidents  of  fratricide  and  collateral  damage.  173  The 
three  brigades  of  the  Army’s  3rd  Infantry  Division  were  stretched  out  over  300  miles  but  were  still 
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able  to  monitor  each  other’s  activities  and  those  of  the  Marines  on  their  flank,  which  was  key  to 
rapidly  reaching  Baghdad.  174  Furthermore,  it  helped  to  more  fully  integrate  air  and  ground 
operations  since  pilots  had  a  much  clearer  picture  of  where  coalition  troops  were  located.175 

Shooter  Grid 

The  shooter  grid  exploits  the  improved  situational  awareness  made  possible  by  the  sensor 
grid  by  precisely  and  discriminately  engaging  targets.  The  extended  standoff  range  and  precision 
of  today’s  munitions  offer  the  joint  force  commander  an  expanded  range  of  options  for  rapidly 
engaging  targets  while  limiting  the  exposure  of  U.S.  troops  to  enemy  fire.  GPS  is  the  DoD 
standard  for  position,  navigation,  and  timing  data  and  is  required  on  all  U.S.  weapon  platforms. 176 

The  accuracy  once  common  to  only  expensive  cruise  missiles  is  now  being  incorporated 
into  virtually  every  future  munition,  including  artillery  and  mortars.  The  number  of  GPS-aided 
weapons  capable  of  being  plugged  into  the  network  will  continue  to  grow,  as  will  our 
vulnerability  to  a  GPS  failure  if  mitigating  procedures  and  backup  systems  are  not  in  place. 
Adding  GPS  to  conventional  guidance  systems  can  trigger  “cascading  value  enhancements”  and 
greatly  increase  the  military  utility  of  the  weapon  system. 177  An  example  is  the  Army  Tactical 
Missile  System  (ATACMS).  In  the  Gulf  War,  ATACMS  used  an  inertial  guidance  system  for 
navigation  and  was  strictly  limited  to  area  targets.  Following  the  war,  GPS  was  added  to  the 
system.  The  increased  accuracy  improved  its  lethality  to  the  point  where  the  number  of  bomblets 
carried  in  the  warhead  was  reduced  from  950  to  300.  This  reduced  the  warhead’s  weight  which, 
in  turn,  increased  its  range  from  160  to  300  kilometers,  placing  a  greater  number  of  enemy  targets 
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at  risk.  During  Iraqi  Freedom,  a  new  warhead  was  married  to  the  system  which  was  very 
successful  against  point  targets  with  minimal  risk  of  collateral  damage.178  Hence  the  mere 
inclusion  of  an  inexpensive  GPS  receiver  improved  lethality,  increased  effective  engagement 
range,  reduced  logistical  requirements,  and  expanded  missions.  The  loss  of  GPS  would  result  in  a 
reversal  of  these  fortunes  by  causing  unexpected  “cascading  failures”  across  the  myriad  of 
systems  that  now  use  GPS. 

Real  world  military  experience  and  past  military  exercises  have  demonstrated  the 
potential  confusion  and  loss  of  combat  power  a  degraded  GPS  could  cause.  During  the  Gulf  War 
when  the  constellation  was  not  yet  fully  operational,  GPS  service  was  lost  for  two  hours  each  day 
over  the  Gulf  region. 179  During  these  periods,  U.S.  and  allied  maneuver  units  often  became  lost 
in  the  featureless  desert.  General  Patrick  Cordingley,  Commander  of  the  British  Seventh 
Armored  Brigade,  later  recalled  his  reliance  on  GPS  for  navigation  during  the  Gulf  War:  “First 
thing  in  the  morning,  and  then  just  after  dark,  the  satellites  that  provided  the  signals  would  go  out 
of  range.  As  a  result  every  morning  and  evening  for  about  fifteen  minutes  we  would  get  lost.” 180 
Military  exercises  that  have  simulated  the  loss  of  GPS  have  significantly  confused  command  and 
control  functions  and  complicated  planning.  In  one  case,  a  GPS  disruption  caused  a  convoy  of 
helicopters  to  ignore  obvious  visual  cues  and  fly  off  in  the  direction  indicated  by  an  inaccurate 
GPS  receiver. 181  It  is  likely  coalition  forces  have  become  more  reliant  on  GPS  since  the  Gulf 
War  and  are  even  more  susceptible  to  limited  disruptions  in  navigation  data.  As  GPS  is  more 
fully  integrated  into  the  NCW  infrastructure,  problems  arising  from  the  loss  or  disruption  of  GPS 
will  be  more  severe. 


Rip  and  Hasik,  133. 

180  McPherson,  15. 

181  John  A.  Volpe  Center,  32. 
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As  the  concept  of  NCW  comes  to  fruition,  military  power  will  no  longer  primarily  reside 
within  the  platforms.  Instead,  true  combat  power  will  be  derived  from  the  network  itself  and  the 
ability  to  contribute  to  the  commander’s  intent  via  the  network.182  Consequently,  the  importance 
of  a  robust  and  fully  functional  network,  enabled  by  GPS,  can  not  be  overestimated.  Robert 
Leonhard  notes  that  the  correct  way  to  assess  the  value  of  a  system  is,  “focusing  not  on  a 
weapon’s  lethality,  but  rather  on  its  complementary  effects  on  other  friendly  weapons.”18’  In  this 
regal'd,  although  GPS  is  not  lethal  and  has  been  categorized  as  a  support  system,  it  can  profoundly 
affect  the  lethality  and  survivability  of  nearly  every  other  weapon  system.  The  proper 
functioning  of  each  grid  within  the  NCW  construct  depends  on  a  viable  and  robust  GPS 
constellation.  There  are  few  military  systems  that  can  claim  the  same  level  of  military  utility  as 
GPS.  Nor  are  there  many  systems  which  could  have  similar  widespread  and  devastating  impact 
on  the  joint  scheme  of  maneuver  as  an  ailing  GPS  constellation. 

Deferred  Modernization 

The  previous  sections  have  explored  the  vulnerabilities  of  various  civil  and  military 
applications  to  a  satellite  failure  with  the  aim  of  illustrating  the  potential  indirect  costs  that  could 
be  incurred  by  a  failing  constellation.  This  last  section  will  discuss  another  “cost”  of  the  LTS 
replenishment  strategy:  the  postponement  of  critical  enhancements  to  the  constellation.  By 
permitting  the  failure  rate  of  satellites  to  define  the  launch  rate.  Air  Force  Space  Command  has 
deferred  the  replacement  of  older  satellites  with  newer,  more  capable  counterparts  by  several 
years.  Figure  4  on  the  next  page  is  a  graphical  depiction  of  the  1995  satellite  replenishment  plan. 
The  1995  plan  forecasted  the  constellation  in  2004  to  consist  of  eighteen  block  HR  satellites  and 

182  William  B.  Scott  and  David  Hughes,  "Nascent  Net-Centric  War  Gains  Pentagon  Toehold," 
Aviation  Week  &  Space  Technology,  [Internet]  (26  January  2003,  accessed  20  January  2004);  available 
from  http://www.aviationnow.com/avnow/news/. 

1 83  Robert  R.  Leonhard,  The  Principles  of  War  for  the  Information  Age  (Novato,  CA:  Presidio 
Press,  1998),  221. 
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six  IIF  satellites;  all  block  II/IIA  satellites  were  to  have  been  decommissioned  by  2003. 
Accordingly,  the  infusion  of  new  technology  has  been  retarded  by  at  least  five  years. 184  More 
significantly,  by  continuing  to  subscribe  to  the  LTS  strategy.  Air  Force  Space  Command  risks 
additional  future  delays.  Owen  Wormser,  the  Assistant  Secretary  of  Defense  responsible  for 
overseeing  space  communications  issues,  has  succinctly  stated,  “the  longer  we  continue  to 
support  the  current  system,  the  worse  we  will  be  in  the  long  run.”185  The  significant  capabilities 
these  modernization  programs  will  bring  to  the  joint  warfighter  are  the  subject  of  the  remainder  of 
this  chapter.  The  capabilities  that  have  been  deferred  in  favor  of  postponing  launches  must  be 
considered  an  “opportunity  cost”  of  the  current  LTS  strategy. 
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Figure  4.  1995  Satellite  Replenishment  Plan186 


184  Michael  Sirak,  "Holding  the  Higher  Ground,"  Jane's  Defence  Weekly,  [Internet]  (8  October 
2003,  accessed  8  October  2003);  available  from  http://ebird.afis.osd.mil/ebfiles/s2003 1008222886.html. 
The  1995  plan  called  for  the  first  launch  of  IIF  in  2001.  Current  plans  place  the  first  IIF  launch  in  late 
2006. 

185  Zolli,  40. 

186  National  Research  Council,  11. 
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Why  Modernize? 


Despite  the  incredible  utility  of  GPS,  the  current  system  has  several  limitations.  The  first 
and  most  significant  of  these  limitations  is  its  susceptibility  to  intentional  jamming  and 
unintentional  signal  interference.  187  Malicious  disruptions  can  range  from  limited  denial  of  GPS 
service  caused  by  a  low  power,  localized  jammer  to  more  catastrophic  incidents  that  could  result 
in  the  denial  of  GPS  service  over  large  geographic  areas  and  for  extended  periods  of  time. 

During  Operation  Iraqi  Freedom,  the  U.S.  saw  the  first  salvos  fired  in  the  struggle  to 
control  space  when  Iraqi  forces  attempted  to  jam  the  GPS  signal  around  Baghdad. 188  Although 
the  U.S.  was  able  to  quickly  eliminate  the  jamming  threat,  the  struggle  for  control  of  the  GPS 
signal  will  increase  in  intensity  for  three  reasons.  First,  as  the  U.S.  military  becomes  more 
dependent  on  its  signal,  GPS  will  become  a  more  enticing  target  for  our  adversaries.  Secondly, 
the  very  low  power  of  the  GPS  signal  makes  it  very  easy  to  jam;  neither  large  amounts  of  power 
nor  sophisticated  technology  is  needed  to  overcome  the  weak  signals. 189  For  instance,  Russia  is 
actively  marketing  a  handheld  jamming  system  slightly  larger  than  a  cigarette  pack  that  is  capable 
of  denying  GPS  service  over  a  120-mile  radius. 190  Lastly,  U.S.  officials  expect  our  adversaries  to 
improve  their  sophistication  and  effectiveness  in  denying  our  use  of  GPS.  “We  know  potential 
adversaries  are  increasing  their  skills,”  said  Adm  James  Ellis,  Commander  of  US  Strategic 
Command.  “We  must  be  ready.”191 


187  For  a  discussion  on  GPS  interference,  see  John  A.  Volpe  Center,  25-34,  63-78.;  Commission  to 
Assess  Space  Management  and  Organization ,  19-20.;  GPS  Risk  Assessment  Study  -  Final  Report  ( Johns 
Hopkins  University  Applied  Physics  Laboratory,  1999)  5- 1  to  5  -10, 1- 1  to  I- 1 1 .;  and  Adams,  (accessed). 

188  Capt.  Chris  Watt,  "Space  Superiority  Essential  to  Warfighters  in  Global  War  on  Terror," 
USAFE  News  Sendee  (13  April  2004)  in  [e-mail  newsletter]  Space  News  (Ft  Leavenworth,  KS:  US  Army 
Command  and  General  Staff  College,  20  April  2004). 

1 89 

U.S.  Space  Command,  Global  Positioning  System  Joint  Concept  of  Operations,  24  November 

1999,  A- 3. 

190  Commission  to  Assess  Space  Management  and  Organization,  20;  and  Bremer  and  Meese,  19- 

20. 

191  Sirak,  (accessed). 
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The  Heritage  Foundation  Homeland  Security  Task  Force  in  their  report,  “Defending  the 
American  Homeland,”  recognized  GPS’  susceptibility  to  jamming.  It  recommended  the 
Department  of  Defense: 

...accelerate  modification  of  GPS  satellites  currently  in  production  to  include  more  robust 
signals.  It  should  begin  launching  these  satellites  at  an  increased  rate  to  augment  the  fragile 
constellation  currently  in  operation... Additional  satellites  with  stronger,  better  designed 
signals  would  increase  availability  and  ensure  operations  by  providing  a  more  robust  signal 
structure  that  is  considerably  less  vulnerable  to  jamming.... Immediate  planning  is  necessary 
to  begin  acquiring  additional  satellites  to  sustain  the  larger  constellation.192 

The  Air  Force  is  also  looking  to  improve  GPS  accuracy  for  both  military  and  civil  users. 
The  service  is  gradually  enhancing  accuracy  from  two  meters  to  less  than  one  meter.  The 
eventual  goal  is  to  refine  the  signal  to  the  twenty-  to  fifty-centimeter  range  to  allow  a  bomb  to  be 
dropped  to  within  one- meter  of  its  target. 193  This  improved  level  of  accuracy  is  needed  to 
minimize  the  risk  of  collateral  damage  and  to  guide  smaller  munitions  to  their  targets  while 
maintaining  the  same  probability  of  damage.194 

Many  civil  users,  such  as  the  aviation  industry,  are  also  seeking  improved  real-time 
accuracy  for  dynamic  applications.  The  primary  source  of  civil  GPS  error  is  ionospheric  delays, 
which  can  normally  add  up  to  seven  meters  of  error. 195  Military  users  are  able  to  correct  for  this 
error  by  comparing  the  ranging  solution  from  the  LI  and  L2  frequency  bands.  Because  civil 
users  currently  have  access  to  only  the  LI  frequency,  they  are  unable  to  correct  for  this  error.  It  is 


1 92  Bremer  and  Meese,  21 . 

1 93  Robert  Wall,  "USAF  Renews  GPS  HI  Focus,"  Aviation  Week  &  Space  Technology,  20  May 
2002,  57. 

194  There  is  a  trend  toward  smaller  munitions.  The  large  2,000 -pound  Joint  Direct  Attack 
Munition  (JDAM)  is  being  augmented  by  a  500- pound  JDAM  variant.  When  placed  into  service  in  2004, 
this  smaller  weapon  will  increase  the  B-2  stealth  bomber’s  capacity  to  deliver  GPS- guided  weapons  by  a 
factor  of  five.  The  B-2  will  be  able  to  independently  strike  up  to  80  separate  targets  on  a  single  bombing 
mission  or  can  destroy  an  enemy  airfield  in  a  single  pass.  A  250 -pound  small  diameter  bomb  is  also  under 
development. 

195  Shaw,  Sandhoo,  and  Turner,  21-22. 
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government  policy  to  add  two  new  civil  frequencies  by  2005  to  enable  civil  users  to  eliminate  this 
source  of  error.196 

Lastly,  the  U.S.  has  a  policy  to  deny  the  enemy’s  use  of  GPS  while  protecting  its  use  by 
allied  military  forces  and  preserving  it  for  civilian  users.  This  capability,  called  NAVWAR,  will 
be  a  significant  force  protection  measure  as  our  adversaries  begin  to  exploit  the  GPS  signal 
against  us  by  integrating  the  technology  into  their  own  cruise  and  ballistic  missiles.  In  order  to 
selectively  and  locally  deny  GPS  signals,  the  military  signal  must  be  spectrally  separated  from  the 
civil  signals.  New  military  codes,  known  as  M-codes,  will  be  added  to  the  signal  structure  to 
prevent  enemy  use  while  limiting  the  “bleed  over”  effects  to  civilians  outside  of  the  area  of 
operation. 

Modernization  Programs 

These  challenges  are  being  met  by  three  new  versions  of  satellites.  The  first  satellite  to 
bring  enhanced  capabilities  to  the  constellation  is  the  modernized  block  HR,  also  known  as  the 
IIR-M.  Presently,  the  Air  Force  plans  to  modernize  eight  of  the  remaining  HR  satellites.  The 
first  IIR-M  launch  was  originally  scheduled  for  March  2003, 197  but  that  has  now  slipped  to  July 
2004.  The  IIR-M  will  significantly  reduce  the  susceptibility  of  the  civil  signal  to  unintentional 
interference  by  doubling  the  power  of  the  signal  and  modulating  the  new  civil  signal  on  L2 
(referred  to  as  L2C). 198  The  L2C  has  the  added  benefit  of  improving  civil  accuracy  by  allowing 
users  to  directly  correct  for  the  ionospheric  delay  error. 

The  IIR-M  will  benefit  military  users  by  adding  a  new  military  signal  (M-code)  onto  the 
existing  LI  and  L2  frequencies.  The  M-code  will  be  a  key  component  of  NAVWAR  and  will 


Dee  Ann  Divis,  "Washington  View,"  GPS  World ,  (13  June  2002,  accessed  3  January  2004); 
available  from  http://www.gpsworld.com/gpsworld/article/articleDetails.jsp7kU21 892. 

198  John  A.  Volpe  Center,  79. 
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enhance  signal  security  and  will  enable  military  users  to  directly  acquire  the  encrypted  signal 
without  having  to  first  acquire  the  easily  jammed  civil  code. 199  The  IIR-M  will  also  have  a  flex 
power  upgrade  to  defeat  low  level  enemy  jamming.  Flex  power  will  allow  operators  to  boost  the 
power  to  either  of  the  military  codes  (M-code  or  the  encrypted  precision  P-code)  by  a  factor  of 
ten.200  These  improvements  will  provide  the  U.S.  military  with  a  limited  anti-jam  capability. 

The  block  IIF  is  the  follow-on  satellite  for  constellation  sustainment.  The  launch  of  the 
first  IIF  satellite  has  slipped  three  years  to  late  2006. 201  In  addition  to  the  enhanced  IIR-M 
capabilities,  the  block  IIF  will  also  add  a  third  civil  frequency  known  as  L5.  The  L5  is 
specifically  designed  to  meet  the  needs  of  safety-of-life  services,  such  as  civil  aviation  and 
maritime  transportation.  The  L5  is  located  within  a  protected  portion  of  the  electromagnetic 
spectrum  reserved  for  aviation  safety-of-life  applications.  This  measure  should  protect  the  signal 
from  unintentional  interference  and  ensure  its  continual  availability  for  critical  applications.  The 
new  civil  frequency  will  provide  signal  redundancy,  improve  positioning  accuracy,  enhance 
signal  availability,  increase  resistance  to  interference,  and  provide  system  integrity. 202 

GPS  III  will  follow  the  IIF  satellites  and  represents  a  quantum  leap  in  capability.  GPS  III 
will  look  at  the  entire  GPS  architecture  to  find  areas  for  improvement  to  ensure  the  system  meets 
the  nation’s  PNT  needs  for  the  next  thirty  years.  It  will  feature  stronger,  jam-resistant  signals, 
more  precision,  and  greater  reliability.  In  2001,  the  launch  of  the  first  GPS  III  satellite  was 
estimated  to  be  in  the  2009  timeframe.203  However,  in  what  has  been  called  the  “single  most 
incomprehensible  move  since  the  Cold  War,”  204  the  Air  Force  cut  funding  for  GPS  III  in  2002  to 


199  Kelley,  Mortoccia,  and  Pendley,  1344.;  and  Shaw,  Sandhoo,  and  Turner,  19. 

200  Wall.  "USAF  Renews  GPS  III  Focus,"  57. 

201  Sirak,  (accessed).;  and  Kelley,  Mortoccia,  and  Pendley,  1344. 

202  Shaw,  Sandhoo,  and  Turner,  18. 

203  de  France,  (accessed). 

2114  Divis,  "Washington  View,"  (accessed). 
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divert  monies  to  other  troubled  space  programs  facing  cost  overruns.  The  cuts  forced  a 
restructuring  of  the  program  and  pushed  the  projected  first  GPS  III  launch  out  to  20 12. 205 

GPS  III  is  looking  to  fix  the  jamming  problem  “once  and  for  all”  206  by  increasing  signal 
power  by  100  to  300  times  over  the  signal  strength  of  the  current  constellation.  In  addition,  GPS 
III  spacecraft  will  have  a  spot  beam  that  can  focus  the  power  and  signal  strength  within  a 
specified  area  of  operations  to  overcome  attempts  at  jamming.207  The  increased  signal  power  will 
improve  its  reception  and  availability  in  virtually  all  terrain  and  atmospheric  conditions.  The 
signals  will  penetrate  thick,  triple  canopy  jungles  and  will  be  available  in  downtown  “urban 
canyons”  where  high-rise  buildings  often  obscure  the  signal.  The  signal  may  even  be  usable 
inside  enclosed  steel  and  concrete  structures  and  underground  facilities. 

GPS  III  will  also  significantly  improve  navigation  and  timing  accuracy.  Today  the 
nominal  positioning  accuracy  is  1.5  to  2  meters  and  5  to  8  nanoseconds  of  clock  error.  GPS  III 
will  drive  positioning  errors  to  less  than  one  meter  and  timing  errors  to  hundreds  of  picoseconds 
(billionths  of  a  second).208 

These  modernization  programs  represent  significant  improvements  in  GPS  capabilities 
for  the  joint  warfighter  and  the  civil  user.  Both  civil  and  military  users  can  expect  to  see 
improvements  in  accuracy,  security,  reliability,  integrity,  and  signal  availability.  Unfortunately, 
the  expanded  capabilities  afforded  by  the  modernized  satellites  have  been  delayed  for  the  sake  of 
maximizing  on-orbit  satellite  life.  While  we  wait  for  obsolete  technology  to  step  aside  for  the 
next- generation  of  satellites,  these  enhanced  capabilities  remain  firmly  grounded. 


205  Ibid,  (accessed).;  and  Mason,  4. 

206  Wall,  "USAF  Renews  GPS  III  Focus,"  57. 

207  Ibid. 

208  Command,  10.;  and  Dee  Ann  Divis,  "GPS  III,  Modernization  Face  Budget  Cuts,"  GPS  World , 
September  2002,  10. 
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CHAPTER  FOUR:  PRECAUTIONARY  RISK  ASSESSMENT 


...the  science  of  risk  management  sometimes  creates  new  risks  even  as  it  brings 
old  risks  under  control.  Our  faith  in  risk  management  encourages  us  to  take  risks 
we  would  not  otherwise  take.  On  most  counts,  that  is  beneficial,  but  we  must  be 
wary  of  adding  to  the  amount  of  risk  in  the  system. 

Peter  L.  Bernstein,  Against  The  Gods:  The  Remarkable  Story  of  Risk209 

When  safety  limits  are  set  ...  the  goal  typically  is  also  to  ensure  “reasonable 
certainty  of  no  harm.”  But  when  current  uses  create  vested  economic  interests  in 
the  status  quo,  risk  assessments  may  readily  be  biased  toward  declaring  practice 
“safe.”  Quite  often,  in  cases  of  this  nature,  the  standard  practice  is  not 
“reasonable  certainty  of  no  harm,”  but  rather  “lack  of  certainty  of  harm,”  which 
is  not  the  same  thing  at  all. 

210 

Dr.  Edward  Groth  III,  Science,  Precaution  and  Food  Safety:  How  Can  We  Do  Better? 


The  essence  of  decision-making  is  making  tradeoffs  among  different  objectives  that  are 
often  in  conflict  with  one  another.  Satellite  replenishment  decisions  are  difficult  because  there  is 
an  inherent  tension  between  maximizing  operational  efficiency  and  mission  effectiveness. 
Complicating  this  tradeoff  is  a  significant  degree  of  risk,  uncertainty,  and  ignorance. 

Satellite  replenishment  decisions  have  several  sources  of  risk,  uncertainty,  and  ignorance. 
We  have  seen  in  previous  chapters  that  our  ability  to  predict  when  a  satellite  will  fail  or  which 
component  will  eventually  falter  is  very  limited.  The  more  accurate  a  prediction,  the  less  precise 
it  is,  and  vice  versa.  Also,  the  long  lead  times  needed  to  build  and  launch  replacement  satellites 
require  satellite  acquisition  decisions  to  be  made  “in  the  blind”  before  all  the  necessary  evidence 
is  on  hand  to  accurately  calculate  satellite  longevity.  This  uncertainty  limits  our  ability  to  strike  a 
balance  between  operational  effectiveness  (defined  as  successful  mission  accomplishment)  and 
efficiency  (optimal  and  economical  use  of  resources).  Additionally,  our  understanding  of  how  a 
satellite  failure  will  ultimately  impact  users  is  even  less  well  understood.  Our  ignorance  in  this 


Bernstein,  335. 

210  Edward  Groth  III,  "Science,  Precaution  and  Food  Safety:  How  Can  We  Do  Better?  [Discussion 
Paper  for  the  US  Codex  Delegation]  (February  2000,  accessed  5  January  2004);  available  from 
http://www.biotech-info.net/precautionary_groth.pdf. 
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regard  is  easily  appreciated  when  one  considers  die  multitude  of  GPS  receivers  built  to  varying 
degrees  of  sophistication  and  quality,  the  dizzying  array  of  GPS  applications  in  sheer  number  and 
diversity,  and  the  complex  interdependencies  among  applications  and  meta-infrastructures. 

Lastly,  our  knowledge  of  the  current  state  of  each  satellite  is  restricted  to  a  stream  of  telemetry 
due  to  their  remote  inaccessibility. 

When  the  probabilities  and  outcomes  of  a  course  of  action  are  known,  numerous 
statistical  tools  and  methods  such  as  cost-benefit  analysis  and  expected  value  theory  can  assist 
risk -based  decisions.  These  tools  can  provide  leaders  with  valuable  insights  which  can  improve 
the  quality  of  decisions.  These  assessments  have  traditionally  been  perceived  as  scientific  and 
objective  evaluations  based  on  the  best  available  facts.  However,  in  cases  where  uncertainty  or 
ignorance  is  high,  these  tools  may  no  longer  be  appropriate.211  Dr.  Groth,  the  senior  scientist  at 
the  Consumers  Union,  explains  the  limitations  of  this  conventional  wisdom:  “quantitative  risk 
assessment  ordinarily,  almost  by  definition,  can  be  done  only  for  comparatively  well- understood 
risks  on  which  good  data  exist.  Less  adequately  understood  risks  may  be  heavily  discounted, 
even  if  they  are  possibly  more  serious  than  the  risks  for  which  we  have  good  data.”212 

Another  limitation  to  the  current  art  of  risk  assessment  is  the  analysis  tends  to  be 
reductionist  in  nature,  problems  are  simplified,  and  relationships  are  treated  linearly.213  However, 
complex  adaptive  systems  have  a  myriad  of  dynamic  and  interdependent  relationships  fueled  by 
feedback  loops  which  cannot  be  treated  linearly.  For  instance,  research  into  the  vulnerabilities  of 
our  nation’s  infrastructure  can  indicate  the  vulnerabilities  of  GPS  to  attack,  but  we  are  largely 
ignorant  of  how  an  anomaly  in  the  GPS  constellation  may  propagate  across  the  power  and 
telecommunication  infrastructures  to  pose  a  hazard  to  the  finance  or  transportation  sectors.  These 


211  Ibid,  (accessed). 

212  Ibid,  (accessed). 

213  Ibid,  (accessed). 
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more  complex  issues  of  determining  the  risks  of  cascading  effects  across  meta-infrastructures  is 
just  now  stalling  to  be  addressed.214 

Under  these  conditions,  the  traditional  approach  to  assessing  risk  may  be  inadequate  and 
more  subjective  than  once  thought.  Specifically,  traditional  assessments  rely  only  on  available 
and  quantifiable  evidence  and  fail  to  explicitly  consider  the  absence  of  evidence  or  evidence 
which  cannot  be  quantified.  In  “Late  Lessons  From  Early  Waitings, ”  its  authors  state,  “Such 
complex  reality  demands  better  science,  characterized  by  more  humility  and  less  hubris,  with  a 
focus  on  ‘what  we  don’t  know’  as  well  as  on  ‘what  we  do  know’.”215 

The  Precautionary  Principle 

One  method  that  has  gained  attention  in  recent  years  for  explicitly  dealing  with 
uncertainty  and  ignorance  is  the  precautionary  principle.  The  precautionary  principle  is  “an 
overarching  framework  of  thinking  that  governs  the  use  of  foresight  in  situations  characterized  by 
uncertainty  and  ignorance  and  where  there  are  potentially  large  costs  to  both  regulatory  action 
and  inaction.”216  Fundamental  to  the  concept  is  the  idea  of  taking  prudent  action  when  the 
possible  consequences  may  be  catastrophic,  even  in  the  absence  of  conclusive  scientific  proof. 

The  principle  has  its  origins  in  the  German  concept  of  Vorsorgeprinzip,  or  foresight 
planning  with  wise  care  and  stewardship.217  During  the  1970s  and  80s,  environmentalists  and 
public  health  advocates  modified  the  concept  as  a  mechanism  for  anticipating  the  adverse  side 
effects  of  new  technologies  in  order  to  minimize  the  collateral  damage  caused  by  their  use  before 
they  could  be  regulated.  The  predominant  regulatory  paradigm  requires  conclusive  scientific 


214  Mahoney  and  Hairnes,  57-58. 

215  J 

'  European  Environmental  Agency,  "Late  Lessons  from  Early  Warnings:  The  Precautionary 
Principle  1896-2000"  [Internet]  (2002,  accessed  13  March  2004);  available  from 
http://reports.eea.eu.int/environmental_issue_report_2001_22/en/Issue_Report_No_22.pdf. 

216  Ibid,  (accessed). 

217  Tim  O'Riordan  and  James  Cameron,  "Interpreting  the  Precautionary  Principle"  [Internet] 
(Earthscan  Publications  Ltd.,  1994,  accessed  5  January  2004);  available  from  http://dieoff.org/page31.htm. 
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evidence  that  harm  is  occurring  before  steps  can  be  taken  to  protect  public  health  or  the 
environment.218  New  products  and  technologies  are  presumed  safe  until  proven  harmful.  The 
dilemma  for  environmental  science  is  that  it  may  take  several  years,  if  ever,  to  collect  enough 
scientific  evidence  to  firmly  establish  stringent  cause  and  effect  relationships  between  an 
offending  technology  and  its  negative  consequences.  By  that  time,  irreversible  or  widespread 
damage  may  already  be  done.  The  precautionary  principle  holds  the  potential  to  resolve  this 
dilemma  by  “providing]  a  rationale  for  taking  action  against  a  practice... in  the  absence  of 
scientific  certainty  rather  than  continuing  the  suspected  practice  while  it  is  under  study,  or 
without  study.”219  In  essence,  the  precautionary  principle  shifts  the  burden  of  proof  away  from 
those  advocating  caution  to  those  who  are  undertaking  the  potentially  hazardous  course  of  action. 

The  application  of  the  precautionary  principle  is  appropriate  if  the  situation  under 
consideration  meets  three  criteria.220  First,  the  potential  hazard  must  represent  a  serious  or 
irreversible  harm  to  society.  Previous  chapters  have  shown  the  pervasiveness  of  GPS  throughout 
the  civilian  infrastructure  and  its  tight  coupling  with  safety-of-life  applications  which  could  lead 
to  catastrophic  regional  consequences  in  case  of  a  failure.  The  potential  harm  to  national  security 
should  GPS  fail  during  a  conflict  could  be  disastrous  as  well.  Second,  the  situation  must  contain 
significant  uncertainty  or  ignorance.  GPS  uncertainty  and  ignorance  exists  at  both  the  satellite 
and  the  meta-infrastructure  level.  Lastly,  there  is  a  compelling  need  to  reduce  the  potential 
hazard  before  one  can  establish  a  strong  causal  linkage  between  the  hazard  and  its  suspected 
consequences.  In  such  cases,  the  time  needed  to  gather  more  information  to  reduce  epistemic 


218  Joel  Tickner,  Carolyn  Raffensperger,  and  Nancy  Myers,  "The  Precautionary  Principle  in 
Action:  A  Handbook"  [Internet]  (n.d.,  accessed  5  January  2004);  available  from  http://www.biotech- 
info.net/handbook.pdf.;  O'Riordan  and  Cameron,  (accessed).;  and  Edward  Groth  III,  "Towards  a  More 
Precautionary  and  More  Scientific  Approach  to  Risk  Management,"  World  Conference  on  Medicine  and 
Health,  [Internet]  (12  August  2000,  accessed  1  March  2004);  available  from  http://www.biotech- 
info.net/towards_precaution.pdf. 

219  Tickner,  Raffensperger,  and  Myers,  (accessed). 

2211  The  first  criteria  are  from  Ibid,  (accessed).;  European  Environmental  Agency,  (accessed), 
expanded  the  litmus  test  for  applying  the  precautionary  principle  by  adding  the  final  criterion. 
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uncertainty  may  seriously  jeopardize  public  safety.  In  our  case,  we  will  expand  this  criterion  to 
include  jeopardizing  mission  accomplishment.  A  review  of  the  criteria  indicates  GPS  satellite 
replenishment  is  a  valid  candidate  for  adopting  the  precautionary  principle.  Adopting  a 
precautionary  risk  assessment  approach  cannot  eliminate  uncertainties  or  avoid  the  consequences 
of  ignorance  altogether,  but  it  does  offer  a  better  chance  for  anticipating  both  real  and  opportunity 
costs  and  ultimately  for  achieving  a  better  balance  between  operational  effectiveness  and 
efficiency. 

One  of  the  difficulties  in  applying  the  precautionary  principle  to  satellite  replenishment 
decisions  is  there  is  no  universally  accepted  definition  for  the  principle.  The  concept  has  been 
encapsulated  in  many  international  agreements  and  treaties  and  has  now  moved  beyond 
environmental  protection  and  into  the  fields  of  biotechnology,  pharmaceutical  safety,  food  safety, 
occupational  safety,  and  consumer  protection. 221  Nevertheless,  the  most  common  definitions  are 
written  with  public  safety  or  environmental  protection  in  mind  and  are  often  too  broad  to  guide 
practical  decision  making  processes.  There  are,  however,  a  number  of  common  elements  that  can 
be  distilled  from  these  numerous  definitions  and  modified  for  our  purposes.  Eliminating  those 
elements  that  deal  exclusively  with  environmental  stewardship  and  retaining  those  concepts  most 
salient  to  satellite  replenishment  strategy,  one  is  left  with  four  tenets. 222 

The  first  tenet  is  a  reframing  of  the  traditional  decision  making  approach  so  the  burden  of 
proof  is  shifted  away  from  those  advocating  protection  toward  those  proposing  a  course  of  action 
that  may  be  harmful.  Sometimes  referred  to  as  “duty  of  care,”  223  this  tenet  suggests  a  more 
conservative  decision  making  process.  It  offers  the  opportunity  to  break  the  chain  of  “logic  of 
failure”  decisions  that  ultimately  lead  to  poor  decisions  with  potentially  catastrophic  results.  This 

221  Groth,  "Science,  Precaution  and  Food  Safety:  How  Can  We  Do  Better?"  (accessed). ;  Tickner, 
Raffensperger,  and  Myers,  (accessed). 

222  O'Riordan  and  Cameron,  (accessed). 

223  Ibid,  (accessed). 
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tenet  changes  the  replenishment  question  facing  decision  makers  from  “Prove  we  need  to  launch” 
to  “Prove  we  don’t  need  to  launch.”  Under  this  new  construct,  the  burden  of  proof  is  shifted 
away  from  those  who  advocate  a  conservative  stance  (i.e.  adhere  to  the  approved  launch 
schedule)  to  those  who  are  recommending  a  riskier  approach  (i.e.  postpone  launch).  This  tenet 
harnesses  the  power  of  the  inherent  uncertainty  involved  in  the  decision  to  help  ensure  that  if  an 
error  in  judgment  is  to  be  made,  it  should  be  made  to  the  benefit  of  mission  effectiveness. 

The  second  tenet  is  termed  “preventive  anticipation.”  Preventive  anticipation  is  “a 
willingness  to  take  action  in  advance  of  scientific  proof  of  evidence  of  the  need  for  the  proposed 
action  on  the  grounds  that  further  delay  will  prove  ultimately  costly  to  society.”224  Unfortunately, 
unambiguous  evidence  of  an  impending  satellite  failure  is  not  always  forthcoming.  An 
unwillingness  to  proactively  replace  an  ailing  satellite  before  it  fails  permits  risk  to  accumulate 
within  the  constellation,  increases  the  probability  of  multiple  satellite  failures,  and  ultimately 
places  users  at  risk.  Decision  makers  must  also  accept  that  current  launch  technology  prevents 
the  rapid  and  timely  replacement  of  a  failed  satellite.  Users  may  be  exposed  to  degraded  GPS 
performance  for  months  while  a  replenishment  launch  is  prepared.  Accordingly,  the  decision  to 
launch  a  replenishment  satellite  must  come  before  a  failure;  otherwise  the  cost  to  society  can  be 
enormous. 

The  next  tenet  obligates  decision  makers  to  safeguard  margins  of  safety.  Margins  of 
safety  and  confidence  levels  should  be  sacrosanct  and  not  be  approached,  let  alone  breached. 

This  requires  the  decision  maker  to  deliberately  constrain  one’s  choices  and  to  adopt  a 
conservative  perspective.  In  the  past,  replenishment  decisions  have  permitted  the  probability  of 
maintaining  twenty-four  satellites  to  dip  below  the  ninety-five  percent  boundary.  These  measures 
erode  the  robustness  and  vitality  of  the  constellation.  In  the  future,  leaders  may  be  tempted  to 

224  Ibid,  (accessed). 
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again  violate  the  mandated  level  of  certainty  as  it  becomes  more  challenging  to  maintain.  The 
precautionary  principle  helps  guard  against  such  a  temptation  by  making  the  ninety-five  percent 
probability  boundary  inviolate.  Decision  makers  are  encouraged  to  take  proactive  measures  to 
build  sufficient  “slack”  into  the  system  to  guard  against  inevitable  frictions  such  as  unforeseen 
launch  delays  and  unpredicted  satellite  failures  which  can  quickly  consume  planning  margins  and 
management  reserves. 

The  final  tenet  is  “proportionality  of  response.”  This  tenet  requires  decision  makers  to 
consider  the  cost-effectiveness  of  the  margins  of  safety  to  show  that  the  selected  degree  of 
restraint  and  conservativeness  is  not  unduly  costly.  This  introduces  a  bias  to  conventional  cost- 
benefit  analysis  to  include  a  “weighting  function  of  ignorance”  and  to  consider  the  costs  of 
possible  second  and  third  order  cascading  effects  due  to  implementing  a  selected  course  of  action. 
One  must  consider  not  only  the  direct  expense  of  a  replenishment  satellite,  but  also  the  relevant 
indirect  costs  that  would  be  incurred  if  a  malfunctioning  satellite  were  to  disrupt  military 
operations  or  place  safety-of-life  applications  in  jeopardy. 

There  are  two  basic  forms  of  the  precautionary  principle:  the  strict  and  active  forms.  225 
The  strict  form  of  the  precautionary  principle  requires  inaction  when  action  might  pose  a  risk. 226 
If  sufficient  proof  of  safety  is  unavailable  for  the  proposed  course  of  action,  then  it  should  be 
rejected.  In  contrast,  the  active  form  calls  for  choosing  less  risky  alternatives  when  they  are 
available,  and  for  taking  responsibility  for  potential  risks.  This  form  calls  for  more  action,  not 


225  Chris  Phoenix  and  Mike  Treder,  "Applying  the  Precautionary  Principle  to  Nanotechnology" 
[Internet]  (January  2003,  accessed  9  March  2004);  available  from 
http://www.cmano.org/precautionary.htm. 

226  An  example  of  the  strict  form  of  the  precautionary  principle  is  reflected  in  how  Air  Force  Space 
Command's  eastern  and  western  launch  range  safety  offices  approach  risk  assessment.  The  range  safety 
office  is  responsible  for  ensuring  the  safe  conduct  of  all  launches.  When  a  launch  provider  wants  to  launch 
a  new  or  significantly  redesigned  booster,  it  is  the  launch  provider's  responsibility  to  first  demonstrate  the 
booster  meets  exacting  safety  standards  before  it  is  certified  for  launch.  Inability  to  adequately  demonstrate 
the  booster’s  safety  results  in  it  not  being  approved  for  launch.  Significantly,  it  is  not  the  responsibility  of 
the  safety  office  to  prove  the  booster  is  unsafe.  In  other  words,  the  onus  of  proof  rests  squarely  with  the 
actor  proposing  the  potentially  dangerous  action:  the  launch  provider. 
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less,  to  find  an  appropriate  mechanism  to  mitigate  the  risk.  It  is  the  active  form  that  best  applies 
to  satellite  replenishment. 

Under  the  active  form  of  the  precautionary  principle,  the  satellite  replenishment  decision 
is  reframed  so  the  default  replenishment  decision  is  to  launch  to  replace  satellites  that  have 
exceeded  their  mean  mission  duration  and  are  showing  signs  of  approaching  their  end-of-life.  In 
the  absence  of  convincing  contradictory  evidence,  the  recommendation  is  to  launch.  The  party 
advocating  that  a  launch  be  delayed  or  cancelled,  for  whatever  reason,  has  the  responsibility  for 
“proving”  the  constellation  will  not  drop  below  its  minimum  performance  standards  within  the 
mid-term  (defined  as  the  next  six  years)  and  modernization  capability  milestones  will  not  be 
effected.  Failure  to  provide  such  convincing  evidence  results  in  the  selection  of  the  default 
decision:  a  recommendation  to  launch. 

Before  precautionary  risk  assessments  can  be  applied  to  satellite  replenishment  decisions, 
more  work  must  be  done  to  “operationalize”  the  principle  for  everyday  use.  The  principle  must 
be  rigorous,  disciplined,  and  defensible  against  challengers.  Moreover,  the  commander’s 
estimate  of  the  current  state  of  the  constellation,  the  commander’s  intent  toward  constellation 
sustainment,  and  his  willingness  to  accept  risk  must  also  be  incorporated  into  the  precautionary 
risk  assessment. 

In  the  meantime,  the  precautionary  principle’s  greatest  value  is  simply  helping  to 
illuminate  the  biases  in  the  current  framework  that  work  against  a  decision  to  launch  and  to 
encourage  decision  makers  to  consider  the  possible  second-  and  third- order  consequences  of  a 
decision  not  to  launch.  By  putting  proper  emphasis  on  what  we  don’t  know,  we  can  put  what  we 
do  know  into  proper  perspective.  A  thorough  analysis  of  the  uncertainties  and  sensitivities  of  our 
risk  assessments  and  assumptions  is  essential.  However,  over  precaution  can  be  expensive  in 
terms  of  lost  opportunities  and  under  investment  in  other  pressing  defense  needs.  The 
precautionary  principle  provides  a  framework  to  balance  the  uncertainties  inherently  involved 
with  satellite  replacement  decisions  while  ensuring  investments  in  the  constellation  are  justified. 


66 


CHAPTER  FIVE:  CONCLUSIONS  AND  RECOMMENDATIONS 


More  and  more  it  is  not  the  single  catastrophic  event  that  disturb  society  the 
most.  Whereas  the  old  disasters  were  spectacular,  the  new  disasters  are  diffuse, 
silent  processes  that  continue  almost  invisibly  and  usually  too  late.  Several  years 
can  separate  cause  from  its  eventual  effect.  Often  the  cause  is  no  longer  a 
singular  event,  but  is  the  cumulative  effect  of  many  small  events.  Whereas  the 
old  disasters  were  bcalized  and  sudden,  the  new  ones  may  be  global  and  gradual. 

Edward  Tenner,  Why  Things  Bite  Back 227 


Conclusions 

The  world  is  developing  a  growing  dependency  on  GPS  services.  Its  highly  accurate, 
globally  available  signal  coupled  with  declining  receiver  prices  has  encouraged  diverse  industries 
to  fully  integrate  it  into  their  processes.  Within  the  United  States,  GPS  is  imbedded  into  nearly 
every  critical  civilian  infrastructure.  The  proper  functioning  of  these  critical  infrastructures,  such 
as  power  and  telecommunications  systems,  is  essential  to  the  country’s  welfare  and  security. 
Safety-of-life  applications,  such  as  the  50,000  aircraft  that  fly  within  the  national  airspace 
everyday,228  count  on  a  reliable  and  accurate  GPS  signal.  In  addition,  GPS  has  spawned  a  $17 
billion  annual  domestic  receiver  market. 229  A  failure  or  degradation  in  GPS  could  significantly 
impact  the  economic  growth,  trade,  and  productivity  of  the  United  States. 

The  U.S.  has  also  come  to  embrace  GPS  has  a  means  for  delivering  shorter,  more 
decisive,  and  less  destructive  military  victories  with  fewer  casualties  for  all.  As  a  “battlefield 
utility,”  the  GPS  signal  is  essential  to  the  functioning  of  the  emerging  network  centric  sensor, 
shooter,  and  information  grids.  The  loss  of  GPS  could  have  disastrous  and  widespread  effects 
across  the  battlefield  as  dispersed  units  are  desynchronized  from  the  operational  plan  and  forced 


Tenner,  25. 

22S  Federal  Aviation  Administration,  "Air  Traffic  Control  System  Command  Center"  [Internet] 
(accessed  2  April  2004);  available  from  http://www.fly.faa.gov/Products/Information/information.html. 
229  Butler. 
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to  operate  with  degraded  command  and  control,  diminished  situational  awareness,  and  without 
the  support  of  long-range  precision  fires. 

The  explosive  growth  of  GPS  over  the  past  fifteen  years  has  outpaced  the  Air  Force’s 
management  policy  on  satellite  replenishment.  The  growing  importance  of  GPS  must  be  matched 
with  a  replenishment  strategy  that  improves  its  utility  for  military,  commercial,  and  international 
users.  However,  the  Launch  to  Sustain  (LTS)  replenishment  strategy,  which  launches  satellites 
only  after  a  failure  or  just  prior  to  failure,  has  led  to  two  problems.  First,  LTS  has  placed  a 
premium  on  maximizing  individual  satellite  life  in  order  to  reduce  constellation  life  cycle  costs. 
Extraordinary  measures  have  been  taken  to  sustain  aging  satellites,  sometimes  even  at  the 
expense  of  signal  accuracy  and  reliability.  These  extraordinary  measures  have  led  to  unsurpassed 
global  performance,  but  it  has  temporarily  hidden  the  declining  state  of  health  of  the 
constellation.  Consequently,  the  situation  has  not  commanded  the  attention  it  merits  from  the 
DoD,  and  the  funding  for  new  launches  has  not  received  the  priority  it  deserves.  As  a  result,  the 
constellation  is  populated  with  numerous  aging  satellites,  causing  overall  risk  to  accumulate 
within  the  constellation.  This  “rearranging  effect”  of  risk  has  led  to  a  more  elusive  and  chronic 
problem  of  a  fragile  constellation  prone  to  multiple  satellite  failures.  The  risk  of  multiple  satellite 
failures  impeding  military  operations  or  degrading  critical  civilian  infrastructure  is  a  very  real 
possibility. 

The  LTS  strategy  has  also  impaired  the  timely  introduction  of  critical  new  capabilities  to 
the  constellation.  By  permitting  the  failure  rate  of  satellites  to  define  the  launch  rate,  the  Air 
Force  has  deferred  the  replacement  of  older  satellites  with  newer,  more  capable  counterparts  by 
several  years.  Modernization  efforts  to  increase  the  signal’s  resistance  to  interference  and 
jamming,  to  improve  accuracy  to  the  sub-meter  level,  and  to  selectively  prevent  our  adversary’s 
use  of  GPS  are  all  critical  to  the  future  success  of  U.S.  forces  on  the  battlefield.  In  addition,  the 
new  satellites  will  incorporate  redundant  civil  signals  and  improved  integrity  monitoring  for 
safety-of-life  applications.  These  improvements  will  likely  generate  entirely  new  GPS  markets 
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and  will  help  ensure  GPS  remains  the  universal  standard  for  navigation  and  timing  services.  The 
following  recommendations  are  made  to  improve  the  satellite  replenishment  process. 

Recommendations 

First  Recommendation.  Instead  of  viewing  satellite  replenishment  as  primarily  an  engineering 
optimization  problem,  it  should  be  perceived  as  an  operational  issue  with  a  central  focus  on  the 
commander’s  acceptance  of  risk  to  the  joint  warfighter  and  the  civil  and  commercial  user.  The 
commander  of  U.S.  Strategic  Command  should  communicate  his  level  of  risk  acceptance  to  the 
Constellation  Sustainment  and  Assessment  Team  (CSAT)  through  a  commander’s  intent 
statement.  Moreover,  leadership  should  consider  an  effective  satellite  replenishment  strategy  as 
the  first  and  most  fundamental  step  in  achieving  and  maintaining  space  superiority.  The  ability  of 
a  space  force  to  operate  “without  prohibitive  interference”  starts  with  capable  and  reliable  on- 
orbit  space  assets  and  the  trained  space  crews  to  operate  them.  Few  adversaries  today  possess  the 
counterspace  capability  to  neutralize  five  medium  earth  orbit  satellites.  However,  the  current 
LTS  strategy  has  accomplished  something  our  adversaries  can  not  do:  it  has  placed  five  GPS 
satellites  at  risk  for  failure  over  the  course  of  the  next  twelve  months. 230  In  addition,  the  LTS 
strategy  has  successfully  denied  worldwide  users  access  to  the  expanded  capabilities  of  the  IIR-M 
satellite  due  to  the  low  launch  rate.  Adopting  a  warfighter  perspective  will  assist  in  restoring 
some  art  and  warfighter  judgment  to  the  science  of  satellite  replenishment. 

Second  Recommendation.  Air  Force  Space  Command  should  replace  the  Launch  to  Sustain 
(LTS)  replenishment  strategy  with  a  Launch  to  Augment  (LTA)  strategy.  The  LTA  strategy  will 
accelerate  the  deployment  of  “increased  operational  capability  above  the  designed  standard  in 


230  Perz,  8. 
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response  to  war,  crisis,  contingency,  or  theater  need,”231  and  will  proactively  replace  ailing 
satellites  before  they  can  place  users  at  risk.  Under  the  LTA  strategy,  replenishment  launches 
should  be  executed  at  the  rate  of  three  to  four  per  year  to  accelerate  the  infusion  of  new 
capabilities.  This  rate  should  continue  until  Full  Operational  Capability  (FOC)  is  achieved  for  the 
new  safety-of-life  L5.  Functioning  satellites  that  are  proactively  replaced  can  either  be  disposed 
or  maintained  in  a  “mothball”  configuration  as  a  quick  reaction  spare  in  case  of  an  unexpected 
failure.  The  timely  improvement  in  system  performance  and  the  reduced  chance  for  degraded 
GPS  service  is  adequate  justification  for  the  additional  cost  of  accelerating  the  launch  schedule. 

GPS  is  vital  to  national  military  and  economic  infrastructures.  Funding  levels  and 
stability  should  be  commensurate  with  its  national  importance  as  a  critical  infrastructure.  The 
$100  million  price  tag  to  procure  and  launch  a  new  satellite  is  expensive,  but  it  also  promises  a 
significant  return  on  investment  in  terms  of  improved  efficiency,  global  commerce,  enhanced 
safety,  and  improved  capability  for  the  warfighter.  In  at  least  two  studies  it  was  found  the  added 
costs  incurred  from  a  fixed  launch  schedule  are  partially  mitigated  by  cost  reductions  through 
multiyear  procurements,  lower  satellite  storage  costs,  and  reduced  contractor  “standing  army” 
expenses.  The  LTA  strategy  allows  new  technology  to  be  rapidly  fielded,  and  it  sustains  a  well- 
defined,  steady  funding  profile.  232 

Third  Recommendation.  A  precautionary-based  risk  management  approach  should  be  integrated 
into  the  deliberate  satellite  replenishment  planning  process.  A  precautionary  risk  assessment 
reframes  the  launch  decision  to  place  the  burden  of  proof  on  those  advocating  a  launch  delay,  as 
opposed  to  those  recommending  a  launch.  A  precautionary  risk  assessment  approach,  in 

231  Air  Force  Space  Command,  Launch  Strategy  and  Scheduling  Procedures,  2-3. 

232  Kelley,  Mortoccia,  and  Pendley,  1345.;  and  White  Paper  on  Future  Global  Positioning  System 
(GPS)  Acquisition  Policy  and  Impacts  (KPMG  Peat  Marwick  LLP,  1996),  13-14. 
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conjunction  with  the  LTA  strategy,  will  ensure  the  inherent  biases  associated  with  extreme 
uncertainty  will  not  work  to  delay  future  launches.  This  will  help  restore  a  proper  balance 
between  operational  effectiveness  and  operational  efficiency.  Furthermore,  risk  assessments  and 
reliability  predictions  must  explicitly  communicate  the  uncertainty  involved  in  them  and  their 
sensitivity  to  changing  assumptions  and  conditions.  The  use  of  sensitivity  analysis  and  scenarios 
to  explore  the  implications  of  different  assumptions  will  aid  decision  makers  in  recognizing  the 
limits  of  our  understanding  of  the  risks  involved  and  the  possible  consequences  of  degraded  GPS 
service. 

Fourth  Recommendation.  The  military  services  should  incorporate  scenarios  simulating  the  loss 
and  degradation  of  GPS  services  into  military  training,  wargames,  and  exercises.  As  the  Space 
Commission  Report  points  out,  “military  commanders  have  had  relatively  little  experience  in 
learning  to  cope  with  the  loss  or  temporary  interruption  of  key  space  capabilities,  such  as  GPS, 
satellite  communications,  remote  sensing  or  missile  warning  information.  Space  capabilities 
should  be  embedded  in  military  exercises.”233  These  scenarios  should  exercise  backup  navigation 
and  command  and  control  systems  and  contingency  procedures.  In  addition,  the  services  should 
develop  models  and  simulations  to  identify  key  military  capabilities  that  are  vulnerable  to  a  loss 
or  degradation  of  GPS  service.  This  will  assist  combatant  commanders  in  developing  necessary 
contingency  plans  for  a  loss  of  GPS.  The  exercises  and  models  will  also  help  identify  acquisition 
requirements  for  supplemental  theater  navigation  and  timing  systems  and  validate  more  stringent 
theater  GPS  availability  and  security  requirements. 


233  Commission  to  Assess  Space  Management  and  Organization,  77 . 
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Fifth  Recommendation.  The  Department  of  Homeland  Security,  in  collaboration  with  the 
Departments  of  Defense,  Justice,  Transportation,  Energy,  and  Commerce  (among  others),  should 
develop  modeling  and  simulation  tools  that  quantify  the  effects  of  a  loss  or  degradation  of  GPS 
on  the  nation’s  critical  infrastructures.  The  tool  could  also  be  integrated  into  homeland  defense 
exercises,  experiments,  and  wargames  to  simulate  the  potential  second-  and  third-order  cascading 
effects  arising  from  a  terrorist  attack  on  vulnerable  infrastructure  systems  and  to  assist  in 
developing  contingency  response  plans.  The  main  goal  is  for  the  integration  of  sectoral  results 
and  the  modeling  of  interdisciplinary  systems  to  gain  an  understanding  of  the  interdependencies 
among  GPS,  its  augmentation  systems,  critical  end-user  applications,  and  the  meta-infrastructure. 

Sixth  Recommendation:  The  Defense  Advanced  Research  Projects  Agency  (DARPA)  and  the 
Naval  Research  Laboratory  (NRL)  should  conduct  research  into  developing  satellite  prognosis 
equipment  that  continually  monitors  critical  satellite  components  for  early  signs  of  failure  and 
alerts  operators  of  a  predicted  malfunction.  Satellite  operators  can  use  the  alert  to  conduct 
additional  analysis  to  verify  the  need  to  command  the  satellite  to  a  redundant,  backup  system  in 
advance  of  the  component  failing.  The  prognosis  equipment  would  support  a  more  proactive 
approach  to  satellite  maintenance  and  help  reduce  the  costly,  unscheduled  downtime  needed  for 
anomaly  resolution  and  reduce  the  risks  to  users  and  the  satellite  arising  from  a  component 
failure.  Research  effort  should  first  focus  on  prognosis  equipment  for  the  atomic  frequency 
standards  since  these  components  are  the  most  likely  to  fail  and  can  cause  the  greatest  harm  to 
users  when  they  do  fail. 
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APPENDIX  A:  GPS  DESCRIPTION 


The  mission  of  GPS  is  to  provide  reliable  worldwide,  high  accuracy,  three  dimensional, 
position,  velocity,  and  time  (PVT)  information  to  military  forces  across  the  full  spectrum  of 
combat  as  well  as  to  civil,  commercial,  and  scientific  users  for  peaceful  purposes. 234  It 
accomplishes  this  mission  through  its  space,  control,  and  user  segments. 


Space  Segment 

The  space  segment  consists  of  at  least  twenty-four  satellites  positioned  in  semi- 
synchronous,  circular  orbits  located  10,898  nautical  miles  above  the  earth’s  surface.  The 
satellites  are  arranged  in  six  orbital  planes  with  four  satellites  in  each  plane.  Each  of  the  six 
orbital  planes  are  inclined  55  degrees  relative  to  the  earth’s  equator.  The  satellites  are 
strategically  positioned  within  each  orbital  plane  so  at  least  four  satellites,  the  minimum  number 
generally  needed  to  calculate  a  user’s  three-dimensional  position,  are  observable  at  any  point  on 

234  The  White  House,  (accessed). 

235  Air  Force  Space  Command,  Concept  of  Operations ,  3-1. 
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the  earth's  surface.  Six  to  ten  satellites  are  typically  visible  to  a  user  in  an  unobstructed,  benign 
environment.236  The  twenty-four  satellite  constellation  configuration  is  pseudo-optimized  to 
minimize  the  impact  on  global  coverage  in  the  event  of  a  single  satellite  failure.237 

Each  satellite  transmits  an  LI  (1575.42  MHz)  and  L2  (1227.6  MHz)  carrier  radio  signal 
for  the  navigation  and  timing  missions  of  GPS.  Two  levels  of  GPS  service  are  superimposed  on 
these  signals:  the  Standard  Positioning  Service  (SPS)  and  the  Precise  Positioning  Service  (PPS). 
Currently,  SPS  is  available  to  the  worldwide  user  community  free  of  charge  and  is  transmitted  on 
the  LI  frequency.  Luture  modernization  programs  will  also  modulate  the  SPS  onto  the  L2 
frequency  and  will  add  a  new  L5  frequency  for  civil  safety -of- life  applications.  The  PPS  is 
encrypted  on  both  the  LI  and  L2  frequencies  and  is  only  available  to  authorized  users  with 
cryptographic  keys.  238  PPS  is  intended  for  U.S.  military  forces,  authorized  government  users,  and 
select  allies. 

Control  Segment 

The  control  segment  is  made  up  of  the  resources  on  the  ground  that  operate,  maintain, 
and  manage  the  space  segment.  Collectively  referred  to  as  the  Operational  Control  Segment 
(OCS),  it  consists  of  the  Master  Control  Station  (MCS),  located  at  Schriever  Air  Lorce  Base,  and 
five  ground  antennas  and  six  monitor  stations  strategically  located  around  the  world.  The  Master 
Control  Station  is  the  focal  point  for  GPS  command  and  control  operations.  Prom  the  MCS, 
satellite  operators  from  2d  Space  Operations  Squadron  (2  SOPS)  continually  monitor  the  health 
and  status  of  the  satellites  to  verify  the  spacecraft  subsystems  are  operating  nominally  and  to 
ensure  navigation  performance  remains  within  acceptable  limits.  Satellite  telemetry  is  received 
by  the  remote  ground  antennas  and  displayed  in  the  MCS  for  satellite  operators  to  monitor  and 

236  Assistant  Secretary  of  Defense  for  Command,  Control,  Communications,  Intelligence,  A- 18. 

237  SS-GPS-300E,  12. 

~3S  Joint  Program  Office,  Navstar  GPS  User  Equipment  Introduction,  1-3. 
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evaluate  the  health  of  the  satellite.  Satellite  operators  conduct  periodic  maintenance, 
troubleshooting,  and  anomaly  resolution  of  the  satellites  by  transmitting  commands  via  the 
ground  antennas. 

In  addition  to  maintaining  the  health  of  the  satellites,  the  OCS  also  monitors  and 
evaluates  the  performance  of  the  navigation  signals.  The  six  unmanned  monitor  stations 
passively  receive  the  L-band  navigation  signals  of  overhead  satellites,  calculate  satellite-ranging 
data,  and  pass  that  information  to  the  MCS.  The  MCS  uses  the  near  real-time  data  to 
continuously  fine-tune  its  sophisticated  computer  models  which  are  used  to  predict  the  orbit 
(ephemeris)  and  clock  behavior  of  each  satellite.  At  least  once  a  day,  each  payload  is  uploaded 
with  the  most  current  model  prediction  for  the  satellite.  As  the  model  ages,  it  gradually  becomes 
less  accurate,  causing  the  navigation  signal  to  degrade.  If  navigation  performance  degrades  to  the 
point  where  it  exceeds  standards,  a  new  navigation  message  is  uploaded  to  the  restore  normal 
accuracy.  By  monitoring  the  navigation  signal  of  each  satellite  nearly  continuously,  the  OCS  is 
able  to  ensure  satellite  navigation  performance  remains  within  tolerance  and  errant  signals  are 
quickly  reigned  in  before  they  can  endanger  users. 

User  Segment 

The  user  segment  consists  of  the  millions  of  users  and  applications  which  use  the 
navigation  and  timing  signals  broadcast  by  GPS  to  calculate  position,  velocity,  and  timing 
measurements.  There  are  currently  over  twenty  million  civil  user  sets  in  use  with  more  than  four 
hundred  thousand  civil  sets  sold  each  month.239 


239  Parkinson,  3. 


75 


APPENDIX  B:  SATELLITE  ANOMALY  CASE  STUDIES 

The  following  two  cases  have  been  selected  to  illustrate  the  potential  for  satellite  failures 
to  cause  potentially  catastrophic  consequences  and  to  uncover  the  limitations  of  graceful 
degradation  from  a  user's  perspective.  While  these  cases  may  not  be  representative  of  most 
satellite  anomalies,  they  nonetheless  depict  the  possibility  for  hazardous  consequences.  At  a  time 
when  multiple  satellite  failures  are  expected  each  year  for  the  foreseeable  future,  these  hazards 
should  be  clearly  understood  and  their  consequences  incorporated  into  the  cost  side  of  the  satellite 
replenishment  ledger. 

Case  One:  SVN  22  Clock  Failure240 

The  most  common  failure  mechanism  on  GPS  satellites  is  the  atomic  frequency  standard 
(AFS).241  The  AFS  generates  a  highly  precise  timing  signal  which  is  fundamental  to  all  payload 
operations  since  a  timing  deviation  as  small  as  one  billionth  of  a  second  results  in  a  one  foot 
ranging  error.242  Although  usually  very  precise,  these  atomic  clocks  are  extremely  sensitive  to 
even  the  minutest  environmental  changes  and  require  constant  monitoring  by  the  satellite 
operators.  As  the  clocks  age,  they  become  more  susceptible  to  failure.  A  clock  failure  may 
manifest  itself  as  either  a  gradual  and  graceful  deterioration  in  performance  or  it  can  be 
instantaneous  and  catastrophic  with  little  or  no  advanced  warning.  In  the  latter  case,  satellite 
operators  must  rapidly  identify  the  problem  and  move  quickly  to  protect  users  from  the  hazardous 
signals.  From  the  time  an  anomaly  is  first  detected,  it  normally  takes  satellite  operators  up  to  one 
hour  to  transmit  a  payload  safing  command.  The  safing  command  protects  users  by  earmarking 


240  Unless  otherwise  noted,  this  case  study  relies  on  unpublished  material  from  Lt  Col  Daniel  P. 
Jordan  memo  to  50  OG/CC,  "Operations  Review  Board  (ORB)  01-003,"  (Schriever  AFB  CO,  10  August 
2001).;  and  Air  Force  Space  Command,  "Global  Positioning  System  (GPS)  Satellite  Vehicle  Number 
(SVN)  22  Anomaly  Review"  (Peterson  AFB  CO,  2001). 

241  Air  Education  and  Training  Command,  47. 

~4~  Office,  Navstar  GPS  User  Equipment  Introduction,  1-2. 
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the  signal  as  “unhealthy,”  which  prevents  it  from  being  used  by  GPS  receivers.  In  the  meantime, 
users  can  be  exposed  to  navigation  errors  of  several  hundred,  sometimes  even  thousands,  of 
meters. 

On  28  July  2001,  satellite  vehicle  number  22  (SVN  22)  experienced  a  severe  navigation 
payload  anomaly  as  it  traveled  in  a  northeasterly  direction  over  the  southeast  Pacific  Ocean 
toward  Central  America  and  the  United  States.  Unfortunately  the  clock  failure  occurred  in  an 
area  where  a  known  “blind  spot”  exists  in  the  GPS  monitoring  network.  When  the  satellite  re¬ 
entered  monitor  station  visibility,  its  initial  performance  data  available  to  the  satellite  operators 
was  inconclusive.  As  a  result,  the  satellite  broadcast  faulty  data  undetected  for  eighty-three 
minutes.  The  subsequent  safing  command  to  protect  users  was  not  issued  until  nearly  two  hours 
after  the  anomaly  had  first  started.  During  that  time,  the  ranging  errors  reached  between  300 
kilometers  to  550  kilometers.  This  single  satellite  failure  effected  navigation  and  timing  users 
throughout  the  Western  Hemisphere  to  varying  degrees  of  severity.  This  anomaly  demonstrates 
the  potential  widespread  consequences  a  single  satellite  failure  can  have  on  users,  even  in  a  fully 
populated  constellation  of  twenty-eight  satellites. 

Post-analysis  discovered  the  satellite  anomaly  had  a  significant  impact  on  national 
transportation  systems.  The  Federal  Aviation  Administration’s  Wide  Area  Augmentation  System 
(WAAS),  a  nationwide  system  of  ground  reference  stations  and  geostationary  satellites  designed 
to  improve  the  accuracy,  availability,  and  integrity  of  GPS  signals,  was  especially  hit  hard.  The 
computer  workstation  clocks  at  the  master  reference  stations  in  both  Los  Angeles  and 
Washington  D.C.  lost  synchronization  with  GPS  time,  causing  the  entire  WAAS  network  to  fail 
for  thirty  minutes.  Fortunately,  the  network  was  still  undergoing  testing  at  the  time  and  was  not 
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yet  fully  operational. 243  Had  the  system  been  in  use  for  airport  approaches  and  landings,  the 
consequences  could  have  been  catastrophic  to  any  one  of  the  four  thousand  to  six  thousand 
aircraft  normally  operating  within  the  national  airspace  during  peak  flight  times. 244  During  the 
course  of  the  anomaly,  eight  different  aircraft  in  the  North  Atlantic  notified  air  traffic  controllers 
that  they  were  experiencing  “severe  GPS  outages  in  their  navigation  systems.”245  Had  the  outage 
been  prolonged,  multiple  Trans-Atlantic  flights  would  have  been  required  to  return  to  the  U.S. 
According  to  an  FAA  controller,  “Depending  upon  the  flow  of  traffic,  a  few  RTB’s  (return  to 
base)  could  have  a  terrible  impact  on  the  oceanic  operation.”246 

The  U.S.  Coast  Guard  Differential  GPS  (DGPS)  network  also  malfunctioned,  which 
effectively  shut  down  the  entire  network  within  the  contiguous  United  States  for  several  minutes. 
This  nationwide  network  of  sixty  reference  stations  is  used  by  sailors  to  navigate  the  restricted 
and  congested  waterways  of  harbors,  inlets,  and  rivers  and  along  the  coast.  The  very  network 
designed  to  protect  shipping  from  hazardous  GPS  signals  was  itself  crippled  by  a  single  GPS 
anomaly. 

Testing  also  showed  the  military  could  have  been  severely  impacted  by  this  anomaly.  A 
common  military  receiver  used  in  many  military  airborne  platforms  was  found  to  have  processed 
errors  as  large  as  550  kilometers.  In  another  case,  a  freight  train  near  Philadelphia  had  its  GPS 
receiver  report  it  was  in  the  vicinity  of  Lansing,  Michigan  before  it  was  no  longer  able  to  track 
the  malfunctioning  satellite.247  Fortunately  the  train  was  not  using  GPS  for  positive  train  control 


243  Col  Rick  Reaser  email  to  Lt  Col  Norman  R.  Albert,  "Re:  E-SSS  (DR  Info)  GPS  SVN  22 
Anomaly  -  Additional  Information,"  (7  August  2001).;  and  Col  Douglas  R.  Loverro  email  to  Lt  Col 
Norman  R.  Albert,  "FAA  SPS  Incident  and  Fall  Out,”  (3  August  2001). 

244  Federal  Aviation  Administration,  (accessed). 

24:1  Pete  Hruz  email  to  Michael  Pumphrey,  "GPS  Unreliability  on  7/28/01,"  (28  July  2001). ; 
Canadian  Space  Geodesy  Forum  and  A  B  Kristinsson,  "Was  There  a  GPS  Outage?"  [Internet]  (2  August 
2001,  accessed  15  December  2003);  available  from 
http://listserv.unb.ca/bin/wa7A2Mnd0 1 08&L=canspace&D=0&P=  1120. 

246  Hruz,  email. 

2 17  Capt  Liz  Roper,  GPS  SVN 22  Anomaly.  Presentation,  HQ  AFSPC/DOOS,  7  September  2001,  9. 
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at  the  time  so  there  was  no  safety  hazard.  Ironically  the  huge  magnitude  of  the  timing  and 
navigation  error  induced  by  this  anomaly  may  have  prevented  it  from  being  worse  than  it  actually 
was;  many  receivers  were  simply  unable  to  track  the  erratic  signal. 

Case  Two:  SVN  14  and  16  Failures 

In  the  early  part  of  2000,  both  SVN  14  and  16  were  operating  well  beyond  their  7.5-year 
design  lives.  SVN  14  was  the  first  block  II  satellite  to  be  launched  and  had  celebrated  its 
eleventh  anniversary  in  February  of  that  year.  SVN  16  was  the  third  oldest  spacecraft  in  the 
constellation,  having  also  been  launched  in  1989.  Both  were  beginning  to  show  their  age  and 
were  operating  on  redundant  backup  components  in  several  subsystems.  They  were  both  running 
on  the  third  of  four  frequency  standards,  and  each  was  operating  with  a  failed  reaction  wheel,  the 
primary  means  for  maintaining  attitude  control.  Their  crippled  state  required  extraordinary 
measures  and  precautions  to  keep  them  operating.248 

On  19  February,  the  SVN  16  experienced  a  brief  atomic  clock  anomaly  which  caused  a 
sharp  rise  in  navigation  and  timing  errors.  Ranging  errors  from  the  satellite  spiked  to  more  than 
450  meters  within  ninety  minutes. 249  Satellite  operators  quickly  responded  to  the  anomaly  by 
commanding  the  satellite's  signal  to  an  “unhealthy”  setting  to  protect  users  from  the  worst  of  the 
errors.  Of  particular  concern  was  the  Space  Shuttle  Endeavor  which  was  conducting  a  $142 


248  Captain  Michael  H.  Rivers,  "2  SOPS  Anomaly  Resolution  on  an  Aging  Constellation,"  ION 
GPS  2000, 19-22  September  2000,  Salt  Lake  City,  UT,  2547-2548.;  and  Gary  L.  Dieter,  "GPS  Block  II 
Operations  Reach  a  Ten  Year  Benchmark:  Managing  a  Mature  Constellation,"  ION  GPS  1999,  14-17 
September  1999,  Nashville,  TN,  2262.  Each  satellite  has  four  reaction  wheels.  A  reaction  wheel  is  a  heavy 
rotating  disc  which  generates  momentum  by  changing  the  rate  of  its  rotational  speed.  By  spinning  the 
correct  combination  of  reaction  wheels,  the  spacecraft  can  impart  the  precise  momentum  needed  to  counter 
a  destabilizing  momentum  along  the  roll,  pitch,  and  yaw  axes.  A  stable  platform  is  an  essential  prerequisite 
for  delivering  a  highly  accurate  navigation  signal.  The  reaction  wheels  on  early  block  II  satellites  are 
susceptible  to  wheel  seizure  due  to  insufficient  lubrication.  In  early  2000,  five  satellites  were  operating 
with  a  failed  reaction  wheel  and  one,  SVN  20,  had  previously  been  disposed  because  of  its  failed  reaction 
wheels. 


249  Rivers,  2549. 
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million  Shuttle  Radar  Topography  Mission  (SRTM)  at  the  time.250  The  SRTM  had  very  stringent 
GPS  timing  requirements,  and  SVN  16’s  erratic  timing  errors  threatened  to  affect  the  mission’s 
success.  Satellite  engineers  devised  an  ingenious  method  to  manually  command  the  satellite 
untrackable  for  the  next  two  days  as  the  shuttle  came  in  and  out  of  view  of  the  ailing  satellite.251 
This  “on-the-fly”  measure  successfully  preserved  the  SRTM,  which  ultimately  generated  the  most 
complete,  near-global,  high-resolution  database  of  the  earth’s  topography  to  date.252 

After  ninety  minutes  SVN  16’s  clock  recovered,  errors  returned  to  normal,  and  service 
was  restored  within  two  days.  Two  weeks  later  the  same  frequency  standard  had  a  catastrophic 
failure;  this  time  errors  climbed  to  1,300  meters  within  90  minutes.  With  two  major  anomalies  in 
two  weeks,  the  clock  was  shut  down,  and  its  last  remaining  clock  was  powered  on.  This  last 
clock  failed  to  properly  stabilize  over  the  course  of  the  next  three  weeks.  Satellite  operators  and 
engineers  struggled  to  resurrect  a  previously  failed  clock  in  a  last  bid  to  restore  the  satellite’s 
mission  capability. 

With  SVN  16  out  of  service  for  the  time  being,  navigation  accuracy  in  the  Gulf  of 
Mexico  and  the  central  United  States  unexpectedly  deteriorated.  The  dilution  of  precision  (DOP) 
in  the  region  was  periodically  rising  above  twenty  in  the  region.253  The  DOP  is  a  unitless 
multiplier  to  navigation  accuracy  based  on  the  geometric  position  of  the  satellites  relative  to  a 
user’s  location.  The  lower  the  DOP  value,  the  better  the  possible  navigation  accuracy.  The 
elevated  DOP  was  causing  positioning  errors  to  be  more  than  eight  times  their  norm.  254  The 


250  NASA,  "SRTM  Mission  Statistics"  [Internet]  (14  March  2000,  accessed  31  March  2004); 
available  from  http://www2.jpl.nasa.gov/srtm/statistics.html. 

251  GPS  Support  Center,  "2000  Archived  Advisories"  [Internet]  (2000,  accessed  30  March  2004); 
available  from 

http://www.schriever.af.mil/GpsSupportCenter/archive/advisory/2000_archived_advisories.htm. 

252  NASA,  "SRTM  Mission"  [Internet]  (4  December  2003,  accessed  31  March  2004);  available 
from  http://www2.jpl.nasa.gov/srtm/mission.htm. 

2X1  Lt  Col  William  K.  Kaneshiro,  "DGPS  Problem  in  Gulf  of  Mex,"  (2000).  email. 

254  Capt  Mike  Rivers  and  SSgt  Roger  Gallardo,  GPS  User  Briefing  for  2  SOPS.  Presentation  to  2 
SOPS  at  Schriever  AFB,  CO,  12  December  2001,  50.  To  gain  a  sense  of  comparison,  the  average  daily 
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large  DOP  values  were  wreaking  havoc  on  the  Coast  Guard's  DGPS  augmentation  network  in 
and  around  the  Gulf.  The  reference  stations  were  malfunctioning  whenever  positional  DOP 
exceeded  a  value  of  eight. 255 

While  operators  struggled  to  bring  another  SVN  16  atomic  clock  on-line,  SVN  14 
experienced  a  second  reaction  wheel  failure.  Each  spacecraft  has  four  reaction  wheels  which  are 
its  primary  means  of  maintaining  a  stable,  earth-pointing  platform.  The  attitude  control 
subsystem  can  maintain  control  in  the  event  of  a  single  reaction  wheel  failure,  but  the  loss  of  a 
second  reaction  wheel  renders  the  satellite  inoperable.  As  the  satellite  slowly  tumbled  out  of 
control,  it  lost  electrical  power  and  autonomously  shutdown  the  payload  and  other  non  life- 
essential  equipment  to  conserve  power.  Through  some  delicate  commanding,  a  team  of  satellite 
operators  and  support  engineers  were  able  to  regain  satellite  control  by  enabling  its  backup 
thrusters.  However,  the  unpredictable  thruster  firings  perturbed  the  satellite's  orbit  which 
induced  large  navigation  ranging  errors.  Without  a  stable  platform  to  support  the  navigation 
payload,  the  satellite  had  to  be  disposed. 

With  SVN  14  and  16  simultaneously  off  the  air,  a  gap  in  GPS  coverage  opened  up  over 
the  central  United  States.  Fewer  than  four  satellites  were  visible  over  portions  of  Oklahoma, 
Kansas,  Nebraska,  and  Texas  resulting  in  a  complete  loss  of  GPS  service  for  approximately  thirty 
minutes  each  day  (see  Figure  4  on  the  next  page).256  In  addition,  the  loss  of  both  satellites 
exacerbated  the  ongoing  DOP  problem  in  the  western  United  States.  The  average  maximum 
position  DOP  routinely  reached  between  200  to  300,  resulting  in  a  positioning  error  of  500  to 
1,000  meters."  In  one  area,  the  maximum  position  DOP  spiked  to  over  888  for  short  periods. 


global  position  DOP  is  2.40.  Assuming  all  other  variables  remain  constant,  accuracy  is  degraded  by  a 
factor  of  8.33. 

255  Kaneshiro.  e-mail 

256  Rivers,  ”2  SOPS  Anomaly  Resolution  on  an  Aging  Constellation,"  2550. 

257  Stephen  Hillman,  interview  with  author  by  telephone,  23  April  2004. 
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Aircraft  were  warned  of  the  navigation  gap.  For  a  period  of  time,  the  large  navigation 
errors  threatened  to  disrupt  operations  at  the  Dallas-Fort  Worth  Airport  which  was  near  the 
coverage  gap  and  the  DOP  spikes.  These  anomalies  also  caused  the  Coast  Guard’s  DGPS 

OCQ 

augmentation  network  along  the  Mississippi  River  to  repeatedly  malfunction." 


Figure  6.  CONUS  DOP  Assessment260 


The  situation  was  partially  resolved  on  9  April,  seven  weeks  after  it  started,  when 
SVN  19  was  maneuvered  to  cover  the  hole  opened  by  the  failures.  But  SVN  19  was  operating  on 


25S  Rivers,  "2  SOPS  Anomaly  Resolution  on  an  Aging  Constellation,"  2550.;  and  Hillman 
telephone  interview. 

259  Capt  Donald  A.  Daugherty  memo  to  AFSPACE/A33,  "Emergency  GPS  Constellation 
Sustainment  and  Assessment  Team  (CSAT)  Minutes,"  (Vandenberg  AFB  CA:  2000). 

260  GPS  Support  Center,  "CONUS  DOP  Assessment  (Unclassified)"  [Internet]  (9  April  2000, 
accessed  4  March  2004);  available  from 

http://www.schriever.af.mil/GpsSupportCenter/archive/advisory/uclas_conus_dop.gif. 
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its  last  atomic  clock  and  was  not  expected  to  survive  much  longer.261  It  was  feared  that  an 
SVN  19  failure  would  reopen  the  coverage  gap.  Consequently,  a  previously  scheduled  launch 
was  redirected  to  permanently  replace  SVN  14.  Service  was  finally  restored  to  normal  on  1  June 
when  the  new  satellite  was  in  place  and  fully  operational.  262 


261  Lt  Col  J.  Kevin  McLaughlin  memo  to  50  OG/CC,  "Commander's  Monthly  Status  Report 
(CMSR)  -  October  1999,"  (Schriever  AFB  CO:  1999).;  and  Rivers,  "2  SOPS  Anomaly  Resolution  on  an 
Aging  Constellation,"  2550. 

262  GPS  Support  Center,  "2000  Archived  Advisories"  (accessed).;  and  Losinski,  2544. 
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